WordPress plugin
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High1
- Medium3
- Low0
All Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token' ≤3.7.1Update to 3.7.2 | CVE-2026-97343 | |
| Critical9.8 | 3.4.1.1 - Authentication Bypass to Admin Account Takeover 3.4.0 – 3.4.1.1Update to 3.4.2 | CVE-2026-8181 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.0.6Update to 2.0.8 | CVE-2025-53193 | |
| Medium6.4 | Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count ≤1.5.6.1Update to 1.5.7 | CVE-2024-1894 | |
| High7.2 | Authenticated (Editor+) SQL Injection ≤1.5.3Update to 1.5.4 | CVE-2024-0405 | |
| Critical9.8 | Unauthenticated SQL Injection 1.4.0 – 1.4.6.1Update to 1.5.0 | CVE-2023-5761 |
- Medium4.3Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
≤3.7.1Update to 3.7.2
- Critical9.83.4.1.1 - Authentication Bypass to Admin Account Takeover
3.4.0 – 3.4.1.1Update to 3.4.2
- Medium4.3Cross-Site Request Forgery
≤2.0.6Update to 2.0.8
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count
≤1.5.6.1Update to 1.5.7
- High7.2Authenticated (Editor+) SQL Injection
≤1.5.3Update to 1.5.4
- Critical9.8Unauthenticated SQL Injection
1.4.0 – 1.4.6.1Update to 1.5.0
Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): common questions
Does Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): 2 critical, 1 high, 3 medium. None are known to affect version null.
How do I check which version of Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) vulnerability?
CVE-2026-97343, published Oct 2, 2026: Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'. Severity: Medium (CVSS 4.3).
Is any Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) vulnerability listed in CISA KEV?
No. None of the known Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) vulnerabilities is currently listed in the CISA KEV catalog.