ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)

Information

Software Type Plugin
Software Slug google-analytics-dashboard-for-wp (view on wordpress.org)
Software Status Active
Software Author smub
Software Website exactmetrics.com
Software Downloads 51,798,227
Software Active Installs 300,000
Software Record Last Updated July 17, 2026

7 Vulnerabilities

Submit a Vulnerability
ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
5.3
CVE-2026-5488
Apr 23, 2026
Researcher: Dmitrii Ignatyev
ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
7.2
CVE-2026-5464
Apr 22, 2026
Researcher: Nguyen Ngoc Duc (duc193)
ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
8.8
CVE-2026-1993
Mar 10, 2026
Researcher: Ali Sünbül
ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
8.8
CVE-2026-1992
Mar 10, 2026
Researcher: Ali Sünbül
ExactMetrics <= 8.1.0 - Missing Authorization
4.3
CVE-2025-24750
Jan 24, 2025
Researcher: Rafie Muhammad
ExactMetrics <= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-23880
May 9, 2023
Researcher: Rafie Muhammad
ExactMetrics <= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting
6.4
CVE-2023-0082
Jan 13, 2023
Researcher: István Márton
Title Status CVE ID CVSS Researchers Date
ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token' Patched CVE-2026-5488 5.3 Dmitrii Ignatyev April 23, 2026
ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process Patched CVE-2026-5464 7.2 Nguyen Ngoc Duc (duc193) April 22, 2026
ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update Patched CVE-2026-1993 8.8 Ali Sünbül March 10, 2026
ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation Patched CVE-2026-1992 8.8 Ali Sünbül March 10, 2026
ExactMetrics <= 8.1.0 - Missing Authorization Patched CVE-2025-24750 4.3 Rafie Muhammad January 24, 2025
ExactMetrics <= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2023-23880 6.4 Rafie Muhammad May 9, 2023
ExactMetrics <= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting Patched CVE-2023-0082 6.4 István Márton January 13, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation