WordPress plugin
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 7 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium4
- Low0
All ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) vulnerabilities
- Medium5.3Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
≤9.1.2Update to 9.1.3
- High7.2Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
≤9.1.2Update to 9.1.3
- High8.89.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
7.1.0 – 9.0.2Update to 9.0.3
- High8.89.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
8.0.0 – 9.0.2Update to 9.0.3
- Medium4.3Missing Authorization
≤8.1.0Update to 8.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.14.1Update to 7.14.2
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
≤7.12.0Update to 7.12.1
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin): common questions
Does ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) have known vulnerabilities?
Yes. VulnCrest Radar lists 7 known vulnerabilities in ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin): 3 high, 4 medium. None are known to affect version null.
How do I check which version of ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) vulnerability?
CVE-2026-5488, published Apr 23, 2026: ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'. Severity: Medium (CVSS 5.3).
Is any ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) vulnerability listed in CISA KEV?
No. None of the known ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) vulnerabilities is currently listed in the CISA KEV catalog.