The SlimStat Analytics plugin for WordPress contains a stored cross-site scripting vulnerability in all versions up to 5.4.11. The vulnerability exists in the User-Agent header processing due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access injected pages. The vulnerability requires the show_complete_user_agent_tooltip setting to be explicitly enabled by an administrator for exploitation, as it is disabled by default. This affects the plugin's analytics functionality and could lead to session hijacking or malicious script execution in WordPress admin panels.