SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce has 28 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 28 are fixed as of October 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 15 high. 2026 was the busiest year with 9 disclosures.
The most common weakness is Cross-Site Scripting, behind 18 of the records (64%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).
Every one of the 28 issues recorded for SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce has a vendor fix available, so running the current release closes all known holes.
17 independent researchers contributed these findings, most of them (5) reported by Supakiad S. (m3ez). SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2023-4598Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode
Read the full analysisVulnerability Records

SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
Author
VeronaLabs
SlimStat Analytics is the real-time WordPress analytics plugin that keeps every visitor on your own server. Most analytics tools quietly hand your audience to someone else’s cloud. SlimStat doesn’t. Every pageview, click and visitor lands in your WordPress database and stays there: yours to read the moment it happens, yours to purge whenever you like, never shipped off to Google or anyone else. SlimStat 6 turns that data into answers. A WooCommerce revenue dashboard puts net sales, orders and top products right beside your traffic. Heatmaps show which pages and buttons people actually click. Channels and UTM Campaigns tell you whether a visit came from search, social, email, paid ads or an AI assistant, and which campaign earned it. Set a goal and watch it convert, or chain steps into a funnel and see exactly where people slip away. And it is all faster: SlimStat 6 reads half as many database rows for its charts and writes far less on every pageview, so your site stays quick while you learn more. Best of all, privacy isn’t a setting you have to hunt for. Anonymized IPs, Do Not Track, a consent banner and scheduled data cleanup are GDPR-ready from the first activation. Thousands of WordPress sites already trust SlimStat to keep their analytics honest, fast and entirely their own. See SlimStat 6 in action: Main Features Real-time analytics — Your site’s pulse, live. Watch each visit land the instant it happens: the page, the spot on the map, the search or link that sent them, how quickly your server replied, human or bot. No sampling, no 24-hour delay. WooCommerce revenue dashboard — Net sales, orders, period comparisons, top products and where your buyers came from, in one page next to your traffic. Switch it on when you’re ready; order sync runs quietly in the background and supports HPOS. WooCommerce 8.3+ required. Heatmaps — See which pages get clicked, how often, on which devices, and the five most clicked links and buttons on each page. SlimStat Pro paints full click and scroll heatmaps over your live pages. Channels and UTM campaigns — Know where every visit really came from: search, social, email, paid, AI assistants and crawlers, or a campaign you tagged. Build and copy campaign links straight from the report. Goals & funnels — Turn raw traffic into answers. Define a goal (a WooCommerce sale, a signup, a key pageview) and see uniques, totals and conversion rate. Chain steps into a funnel to spot exactly where visitors drop off. One goal is free; up to five goals and full funnels unlock with Pro. Built for performance — A light tracker that writes far less per pageview, charts that read half as many database rows, and a choice of client-side tracking for cached sites or server-side to catch every request. Complete access log — Every visit in one searchable table. Drill into the full history and break it down by date, country, browser, OS, referrer, search term or content type to answer the questions the summary charts can’t. Outbound links & downloads — See which external links and files actually earn clicks, so you know what sends traffic off your site and which partnerships pull their weight. Know your visitors — Go past pageviews to the people behind them: returning readers, logged-in users, and a full audience breakdown by country, language, browser, OS and screen size. (Pro’s User Overview adds per-visitor journeys, time on site and Gravatars.) Your data, your server — No third-party cloud, no Google looking over your shoulder. Every byte lives in your WordPress database, and one-way IP hashing lets you count unique visitors without ever storing who they are. GDPR, sorted — Anonymize or hash IPs, honor Do Not Track, auto-purge old records on a schedule, and drop in a translatable consent banner that snaps straight into the WP Consent API (WPML and Polylang welcome). Compliance by design, not an afterthought. Geolocation & world map — Put a city and country to every visitor, plus their browser and operating system, powered by MaxMind and Browscap. Watch your audience light up across the globe, even from your phone (map by JQVMap). Shortcodes & Shortcode Playground — Drop any report, live counter or Ecommerce KPI into a post, page or widget. Browse, preview with your own data and copy the shortcode under SlimStat → Shortcodes. Admin bar stats — Keep an eye on the numbers without leaving your work. Online visitors, pageviews and top pages sit one glance away in the WordPress admin bar, on every screen. Make every report yours — Rearrange, add or hide widgets across Real-Time, Overview, Audience, Site Analysis and Traffic Sources until each screen shows exactly what you care about. Filters — Decide who counts. Skip your own team, known bots, whole IP ranges, admin pages or entire countries so your stats reflect real visitors, not noise. Export & email — Download your reports as CSV files, or get the numbers that matter in your inbox each morning (email reports and Excel export via Pro). Cache-friendly — Plays nicely with W3 Total Cache, WP Super Cache, Cloudflare and most caching plugins. Pro Pack Features Love the free plugin? SlimStat Pro is for sites that live by their numbers. It adds the heavier tools without changing a thing about how SlimStat respects your data: Heatmaps that show you what to fix — Click and scroll heatmaps on a phone, tablet or desktop preview, with plain-language insights on dead clicks, rage clicks and scroll drop-off, and an overlay painted right over your live pages. WooCommerce, deeper — Campaigns, landing pages, devices, guest and account buyers, coupons and product refunds added to the revenue dashboard, plus filtered CSV export. Email reports — Wake up to the numbers that matter. Schedule the reports you care about, including store revenue and heatmap insights, and have them land in your inbox as clean HTML tables or CSV. More goals & funnels — Up to five conversion goals and three full funnels, with ready-made templates for WooCommerce checkout, signups and content engagement. User overview — Follow individual registered users: what they viewed, how long they stayed and how fast your server answered, with Gravatars to put a face to the visit. Extended overview — Add your own columns to the User Overview report and export file, so it tracks exactly what your site cares about. Network analytics — Run reports and settings across an entire multisite network from one place. MaxMind integration — Connect MaxMind’s geolocation API for richer, more precise detail on where your visitors come from. Custom database — Store all your analytics in a separate, external database to keep your main WordPress DB lean. Export to Excel — Download any report as a ready-to-share Excel file. Requirements WordPress 5.6+ PHP 7.4+ MySQL 5.6+ (or MariaDB 10.0+) At least 5 MB of free web space (240 MB if you plan on using the external libraries for geolocation and browser detection) At least 10 MB of free DB space At least 32 Mb of free PHP memory for the tracker (peak memory usage) Please note Optional database downloads: If an administrator enables or updates browser detection or DB-IP geolocation, SlimStat downloads the Browscap database from GitHub and the DB-IP Lite database from jsDelivr. No analytics data is sent with these requests. Your stats survive uninstalling. Deleting Slimstat Analytics keeps every visit, setting and table in your database, so reinstalling picks up exactly where you left off. If you want the data gone — decommissioning a site, or honouring a data-erasure request — turn on Settings → Maintenance → “Delete Data on Uninstall” before deleting the plugin, then delete it. That is the only one-step option that removes everything, archive tables included. Deleting the plugin on its own will not clear the database. Delete Records (Settings → Maintenance) clears your live records but not the archived ones in wp_slim_stats_archive / wp_slim_events_archive, which still count as retained data under GDPR. If you are handling an erasure request and want to keep the plugin installed, clear the records and empty those archive tables. Slimstat’s browser-detection cache (in wp-content/uploads/wp-slimstat) is always removed on uninstall — it is a rebuildable cache, not your analytics. The geolocation database there is removed only if you opted into full deletion, because some hosts require it to be uploaded by hand. Report Bugs Found a bug, or want to suggest a feature? Please open an issue on GitHub and pick the matching form. Kindly note that GitHub is for bug reports and feature requests only — support questions belong in the WordPress.org support forum and will be closed there. For security vulnerabilities, please report them through the Patchstack Vulnerability Disclosure Program. The Patchstack team will validate, triage, and handle any security issues.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C