VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WP Statistics – Simple, privacy-friendly Google Analytics alternative security & vulnerabilities

wp-statistics— active installsLast vulnerability Oct 2, 2026

No known unpatched vulnerabilities in the latest version

All 44 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
44Known vulnerabilities
  • Critical5
  • High20
  • Medium19
  • Low0
Vulnerabilities per year
2012: 1 vulnerability1122014: 2 vulnerabilities2142015: 3 vulnerabilities3152017: 4 vulnerabilities4172019: 4 vulnerabilities4192021: 3 vulnerabilities3212022: 12 vulnerabilities12222023: 2 vulnerabilities2232024: 1 vulnerability1242025: 3 vulnerabilities3252026: 9 vulnerabilities926

All WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities

WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.16.13Update to 14.16.14
CVE-2026-93770
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.16.11Update to 14.16.12
CVE-2026-84774
High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
≤14.16.8Update to 14.16.9
CVE-2026-15780
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.16.6Update to 14.16.7
CVE-2026-48839
High7.2Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
≤14.16.4Update to 14.16.5
CVE-2026-5231
High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent Header
≤14.15.4Update to 14.15.5
CVE-2025-9816
High7.2Unauthenticated Stored Cross-Site Scripting
≤14.5Update to 14.5.1
CVE-2024-2194
High7.2Authenticated (Admin+) SQL Injection
≤13.2.16Update to 14.0
CVE-2023-0955
High8.8Authenticated (Subscriber+) SQL Injection
≤13.2.10Update to 13.2.11
CVE-2022-38074
High7.2Authenticated (Admin+) SQL Injection
≤13.2.8Update to 13.2.9
CVE-2022-4230
High8.8Authenticated (Subscriber+) SQL Injection
≤13.2.5Update to 13.2.6
—
High7.2Unauthenticated Stored Cross-Site Scripting via platform
≤13.1.5Update to 13.1.6
CVE-2022-25307
Critical9.8Unauthenticated Blind SQL Injection via IP
≤13.1.5Update to 13.1.6
CVE-2022-25149
Critical9.8Unauthenticated Blind SQL Injection via current_page_type
≤13.1.5Update to 13.1.6
CVE-2022-0651
Critical9.8Unauthenticated SQL Injection
≤13.1.5Update to 13.1.6
CVE-2022-25148
High7.2Unauthenticated Stored Cross-Site Scripting via IP
≤13.1.5Update to 13.1.6
CVE-2022-25305
High7.2Unauthenticated Stored Cross-Site Scripting via browser
≤13.1.5Update to 13.1.6
CVE-2022-25306
Critical9.8Unauthenticated Blind SQL Injection
≤13.1.4Update to 13.1.5
CVE-2022-0513
High7.5Unauthenticated SQL Injection
<13.0.8Update to 13.0.8
CVE-2021-24340
High7.2Unauthenticated Stored Cross-Site Scripting via IP Manipulation
≤12.6.6.1Update to 12.6.7
—
Critical9.8Unauthenticated Blind SQL Injection
≤12.6.6.1Update to 12.6.7
CVE-2019-13275
High8.8Authenticated SQL Injection
≤12.0.7Update to 12.0.8
CVE-2017-18515
High8.7Authenticated Blind SQL Injection
<9.4.1Update to 9.4.1
—
High7.2Stored Cross-Site Scripting
≤8.4Update to 8.5
—
High7.2Multiple Cross-Site Scripting
<8.3.1Update to 8.3.1
—

WP Statistics – Simple, privacy-friendly Google Analytics alternative: common questions

Does WP Statistics – Simple, privacy-friendly Google Analytics alternative have known vulnerabilities?

Yes. VulnCrest Radar lists 44 known vulnerabilities in WP Statistics – Simple, privacy-friendly Google Analytics alternative: 5 critical, 20 high, 19 medium. None are known to affect version null.

How do I check which version of WP Statistics – Simple, privacy-friendly Google Analytics alternative I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerability?

CVE-2026-97276, published Oct 2, 2026: WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting. Severity: Medium (CVSS 6.1).

Is any WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerability listed in CISA KEV?

No. None of the known WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?