It appears that wp-slimstat version 0.92 for Wordpress 2.3 suffers from a cross site scripting vulnerability.