WP Statistics – Simple, privacy-friendly Google Analytics alternative

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Statistics – Simple, privacy-friendly Google Analytics alternative

Information

Software Type Plugin
Software Slug wp-statistics (view on wordpress.org)
Software Status Active
Software Author veronalabs
Software Website wp-statistics.com
Software Downloads 36,203,786
Software Active Installs 600,000
Software Record Last Updated July 19, 2026

Showing 1-20 of 38 Vulnerabilities

Submit a Vulnerability
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-48839
Jun 1, 2026
Researcher: daroo
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
6.5
CVE-2026-3488
Apr 16, 2026
Researcher: Jack Pas (Dark.)
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
7.2
CVE-2026-5231
Apr 16, 2026
Researcher: daroo
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
7.2
CVE-2025-9816
Sep 26, 2025
Researcher: Dmitrii Ignatyev
WP Statistics <= 14.15 - Missing Authorization
4.3
CVE-2025-55716
Aug 14, 2025
Researcher: Denver Jackson
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
5.4
CVE-2025-3953
Apr 29, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-2194
Mar 11, 2024
Researcher: Tim Coen
WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection
7.2
CVE-2023-0955
Mar 6, 2023
Researcher: Erwan LR
WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2022-38074
Jan 31, 2023
Researcher: Rafie Muhammad
WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection
7.2
CVE-2022-4230
Dec 27, 2022
Researcher: Jordy Versmissen
WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection
8.8
CVE ID Unknown
Sep 8, 2022
Researchers:
WP Statistics <= 13.2.5 - Information Disclosure
4.3
CVE ID Unknown
Sep 7, 2022
Researchers:
WP Statistics <= 13.1.7 - Cross-Site Scripting
6.1
CVE-2022-27231
May 24, 2022
Researcher: Shogo Kumamaru
WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting
6.1
CVE-2022-1005
May 11, 2022
Researcher: Taurus Omar
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform
7.2
CVE-2022-25307
Feb 17, 2022
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type
9.8
CVE-2022-0651
Feb 16, 2022
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser
7.2
CVE-2022-25306
Feb 16, 2022
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
WP Statistics <= 13.1.5 - Unauthenticated SQL Injection
9.8
CVE-2022-25148
Feb 16, 2022
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP
9.8
CVE-2022-25149
Feb 16, 2022
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP
7.2
CVE-2022-25305
Feb 16, 2022
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
Title Status CVE ID CVSS Researchers Date
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-48839 7.2 daroo June 1, 2026
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation Patched CVE-2026-3488 6.5 Jack Pas (Dark.) April 16, 2026
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter Patched CVE-2026-5231 7.2 daroo April 16, 2026
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header Patched CVE-2025-9816 7.2 Dmitrii Ignatyev September 26, 2025
WP Statistics <= 14.15 - Missing Authorization Patched CVE-2025-55716 4.3 Denver Jackson August 14, 2025
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update Patched CVE-2025-3953 5.4 Trương Hữu Phúc (truonghuuphuc) April 29, 2025
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-2194 7.2 Tim Coen March 11, 2024
WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection Patched CVE-2023-0955 7.2 Erwan LR March 6, 2023
WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection Patched CVE-2022-38074 8.8 Rafie Muhammad January 31, 2023
WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection Patched CVE-2022-4230 7.2 Jordy Versmissen December 27, 2022
WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection Patched 8.8 September 8, 2022
WP Statistics <= 13.2.5 - Information Disclosure Patched 4.3 September 7, 2022
WP Statistics <= 13.1.7 - Cross-Site Scripting Patched CVE-2022-27231 6.1 Shogo Kumamaru May 24, 2022
WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting Patched CVE-2022-1005 6.1 Taurus Omar May 11, 2022
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform Patched CVE-2022-25307 7.2 Muhammad Zeeshan (Xib3rR4dAr) February 17, 2022
WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type Patched CVE-2022-0651 9.8 Muhammad Zeeshan (Xib3rR4dAr) February 16, 2022
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser Patched CVE-2022-25306 7.2 Muhammad Zeeshan (Xib3rR4dAr) February 16, 2022
WP Statistics <= 13.1.5 - Unauthenticated SQL Injection Patched CVE-2022-25148 9.8 Muhammad Zeeshan (Xib3rR4dAr) February 16, 2022
WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP Patched CVE-2022-25149 9.8 Muhammad Zeeshan (Xib3rR4dAr) February 16, 2022
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP Patched CVE-2022-25305 7.2 Muhammad Zeeshan (Xib3rR4dAr) February 16, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation