WordPress plugin
Site Kit by Google – Analytics, Search Console, AdSense, Speed security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium2
- Low1
All Site Kit by Google – Analytics, Search Console, AdSense, Speed vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Cross-Site Request Forgery ≤1.186.0Update to 1.187.0 | CVE-2026-62139 | |
| Low2.7 | Missing Authorization to Authenticated (Editor+) Settings Update <1.176.0Update to 1.176.0 | CVE-2026-10753 | |
| Medium4.3 | Sensitive Information Disclosure ≤1.7.1Update to 1.8.0 | CVE-2020-8934 |
- Medium4.3Cross-Site Request Forgery
≤1.186.0Update to 1.187.0
- Low2.7Missing Authorization to Authenticated (Editor+) Settings Update
<1.176.0Update to 1.176.0
- Medium4.3Sensitive Information Disclosure
≤1.7.1Update to 1.8.0
Site Kit by Google – Analytics, Search Console, AdSense, Speed: common questions
Does Site Kit by Google – Analytics, Search Console, AdSense, Speed have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Site Kit by Google – Analytics, Search Console, AdSense, Speed: 2 medium, 1 low. None are known to affect version null.
How do I check which version of Site Kit by Google – Analytics, Search Console, AdSense, Speed I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Site Kit by Google – Analytics, Search Console, AdSense, Speed vulnerability?
CVE-2026-62139, published Sep 10, 2026: Site Kit by Google – Analytics, Search Console, AdSense, Speed <= 1.186.0 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).
Is any Site Kit by Google – Analytics, Search Console, AdSense, Speed vulnerability listed in CISA KEV?
No. None of the known Site Kit by Google – Analytics, Search Console, AdSense, Speed vulnerabilities is currently listed in the CISA KEV catalog.