VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WP Statistics – Simple, privacy-friendly Google Analytics alternative security & vulnerabilities

wp-statistics— active installsLast vulnerability Oct 2, 2026

No known unpatched vulnerabilities in the latest version

All 44 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
44Known vulnerabilities
  • Critical5
  • High20
  • Medium19
  • Low0
Vulnerabilities per year
2012: 1 vulnerability1122014: 2 vulnerabilities2142015: 3 vulnerabilities3152017: 4 vulnerabilities4172019: 4 vulnerabilities4192021: 3 vulnerabilities3212022: 12 vulnerabilities12222023: 2 vulnerabilities2232024: 1 vulnerability1242025: 3 vulnerabilities3252026: 9 vulnerabilities926

All WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities

WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.1Reflected Cross-Site Scripting
≤14.16.14Update to 14.16.15
CVE-2026-97276
Medium6.1Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
≤14.16.14Update to 14.16.15
CVE-2026-97652
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.16.13Update to 14.16.14
CVE-2026-93770
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.16.11Update to 14.16.12
CVE-2026-84774
High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
≤14.16.8Update to 14.16.9
CVE-2026-15780
Medium4.3Authenticated (Subscriber+) Information Exposure
≤14.16.9Update to 14.16.10
CVE-2026-16562
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.16.6Update to 14.16.7
CVE-2026-48839
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
≤14.16.4Update to 14.16.5
CVE-2026-3488
High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
≤14.16.4Update to 14.16.5
CVE-2026-5231
High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
≤14.15.4Update to 14.15.5
CVE-2025-9816
Medium4.3Missing Authorization
≤14.15Update to 14.15.2
CVE-2025-55716
Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
≤14.13.3Update to 14.13.4
CVE-2025-3953
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.5Update to 14.5.1
CVE-2024-2194
High7.2Authenticated (Admin+) SQL Injection
≤13.2.16Update to 14.0
CVE-2023-0955
High8.8Authenticated (Subscriber+) SQL Injection
≤13.2.10Update to 13.2.11
CVE-2022-38074
High7.2Authenticated (Admin+) SQL Injection
≤13.2.8Update to 13.2.9
CVE-2022-4230
High8.8Authenticated (Subscriber+) SQL Injection
≤13.2.5Update to 13.2.6
—
Medium4.3Information Disclosure
13.2.5 – 13.2.5Update to 13.2.6
—
Medium6.1Cross-Site Scripting
<13.2.0Update to 13.2.0
CVE-2022-27231
Medium6.1Reflected Cross-Site Scripting
<13.2.2Update to 13.2.2
CVE-2022-1005
High7.2Unauthenticated Stored Cross-Site Scripting via platform
≤13.1.5Update to 13.1.6
CVE-2022-25307
Critical9.8Unauthenticated Blind SQL Injection via IP
≤13.1.5Update to 13.1.6
CVE-2022-25149
Critical9.8Unauthenticated Blind SQL Injection via current_page_type
≤13.1.5Update to 13.1.6
CVE-2022-0651
Critical9.8Unauthenticated SQL Injection
≤13.1.5Update to 13.1.6
CVE-2022-25148
High7.2Unauthenticated Stored Cross-Site Scripting via IP
≤13.1.5Update to 13.1.6
CVE-2022-25305
High7.2Unauthenticated Stored Cross-Site Scripting via browser
≤13.1.5Update to 13.1.6
CVE-2022-25306
Critical9.8Unauthenticated Blind SQL Injection
≤13.1.4Update to 13.1.5
CVE-2022-0513
Medium6.5Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
≤13.1.1Update to 13.1.2
CVE-2021-4333
Medium6.1Reflected Cross-Site Scripting
≤13.0.9Update to 13.1
—
High7.5Unauthenticated SQL Injection
<13.0.8Update to 13.0.8
CVE-2021-24340
High7.2Unauthenticated Stored Cross-Site Scripting via IP Manipulation
≤12.6.6.1Update to 12.6.7
—
Critical9.8Unauthenticated Blind SQL Injection
≤12.6.6.1Update to 12.6.7
CVE-2019-13275
Medium6.4Stored Cross-Site Scripting
≤12.6.5Update to 12.6.6.1
CVE-2019-12566
Medium6.1Referer Cross-Site Scripting
≤12.6.3Update to 12.6.4
CVE-2019-10864
Medium6.1Authenticated Cross-Site Scripting
≤12.0.9Update to 12.0.10
CVE-2017-10991
Medium6.1Reflected Cross-Site Scripting
≤12.0.8.1Update to 12.0.9
—
High8.8Authenticated SQL Injection
≤12.0.7Update to 12.0.8
CVE-2017-18515
Medium6.1Stored Cross-Site Scripting
≤12.0.4Update to 12.0.5
CVE-2017-2136
Medium6.1Cross-Site Scripting
≤9.5.1Update to 9.5.2
—
High8.7Authenticated Blind SQL Injection
<9.4.1Update to 9.4.1
—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
<9.1.3Update to 9.1.3
—
High7.2Stored Cross-Site Scripting
≤8.4Update to 8.5
—
High7.2Multiple Cross-Site Scripting
<8.3.1Update to 8.3.1
—
Medium6.1Cross-Site Scripting
≤2.2.4Update to 2.2.5
—

WP Statistics – Simple, privacy-friendly Google Analytics alternative: common questions

Does WP Statistics – Simple, privacy-friendly Google Analytics alternative have known vulnerabilities?

Yes. VulnCrest Radar lists 44 known vulnerabilities in WP Statistics – Simple, privacy-friendly Google Analytics alternative: 5 critical, 20 high, 19 medium. None are known to affect version null.

How do I check which version of WP Statistics – Simple, privacy-friendly Google Analytics alternative I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerability?

CVE-2026-97276, published Oct 2, 2026: WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting. Severity: Medium (CVSS 6.1).

Is any WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerability listed in CISA KEV?

No. None of the known WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?