WP Statistics – Simple, privacy-friendly Google Analytics alternative

Software Type	Plugin
Software Slug	wp-statistics (view on wordpress.org)
Software Status	Active
Software Author	veronalabs
Software Website	wp-statistics.com
Software Downloads	38,260,986
Software Active Installs	500,000
Software Record Last Updated	October 16, 2026

Showing 1-20 of 44 Vulnerabilities

Submit a Vulnerability

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting

6.1

CVE-2026-97276

Oct 2, 2026

Researcher: b1ue0cean

WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

6.1

CVE-2026-97652

Oct 1, 2026

Researcher: Jakub Herman

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2026-93770

Sep 24, 2026

Researcher: Intrudify

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2026-84774

Sep 2, 2026

Researcher: TwinSecKR

WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

7.2

CVE-2026-15780

Aug 18, 2026

Researcher: tipsen

Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure

4.3

CVE-2026-16562

Aug 3, 2026

Researcher: Shivamani Vastrala

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2026-48839

Jun 1, 2026

Researcher: daroo

WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

6.5

CVE-2026-3488

Apr 16, 2026

Researcher: AlexHenry

WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter

7.2

CVE-2026-5231

Apr 16, 2026

Researcher: daroo

WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

7.2

CVE-2025-9816

Sep 26, 2025

Researcher: Dmitrii Ignatyev

WP Statistics <= 14.15 - Missing Authorization

4.3

CVE-2025-55716

Aug 14, 2025

Researcher: Denver Jackson

WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update

5.4

CVE-2025-3953

Apr 29, 2025

Researcher: Trương Hữu Phúc (truonghuuphuc)

WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-2194

Mar 11, 2024

Researcher: Tim Coen

WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection

7.2

CVE-2023-0955

Mar 6, 2023

Researcher: Erwan LR

WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2022-38074

Jan 31, 2023

Researcher: Rafie Muhammad

WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection

7.2

CVE-2022-4230

Dec 27, 2022

Researcher: Jordy Versmissen

WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection

8.8

CVE ID Unknown

Sep 8, 2022

Researchers:

WP Statistics <= 13.2.5 - Information Disclosure

4.3

CVE ID Unknown

Sep 7, 2022

Researchers:

WP Statistics <= 13.1.7 - Cross-Site Scripting

6.1

CVE-2022-27231

May 24, 2022

Researcher: Shogo Kumamaru

WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting

6.1

CVE-2022-1005

May 11, 2022

Researcher: Taurus Omar

Title	Status	CVE ID	CVSS	Researchers	Date
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting	Patched	CVE-2026-97276	6.1	b1ue0cean	October 2, 2026
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key	Patched	CVE-2026-97652	6.1	Jakub Herman	October 1, 2026
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2026-93770	7.2	Intrudify	September 24, 2026
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2026-84774	7.2	TwinSecKR	September 2, 2026
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter	Patched	CVE-2026-15780	7.2	tipsen	August 18, 2026
Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure	Patched	CVE-2026-16562	4.3	Shivamani Vastrala	August 3, 2026
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2026-48839	7.2	daroo	June 1, 2026
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation	Patched	CVE-2026-3488	6.5	AlexHenry	April 16, 2026
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter	Patched	CVE-2026-5231	7.2	daroo	April 16, 2026
WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header	Patched	CVE-2025-9816	7.2	Dmitrii Ignatyev	September 26, 2025
WP Statistics <= 14.15 - Missing Authorization	Patched	CVE-2025-55716	4.3	Denver Jackson	August 14, 2025
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update	Patched	CVE-2025-3953	5.4	Trương Hữu Phúc (truonghuuphuc)	April 29, 2025
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2024-2194	7.2	Tim Coen	March 11, 2024
WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection	Patched	CVE-2023-0955	7.2	Erwan LR	March 6, 2023
WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2022-38074	8.8	Rafie Muhammad	January 31, 2023
WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection	Patched	CVE-2022-4230	7.2	Jordy Versmissen	December 27, 2022
WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection	Patched		8.8		September 8, 2022
WP Statistics <= 13.2.5 - Information Disclosure	Patched		4.3		September 7, 2022
WP Statistics <= 13.1.7 - Cross-Site Scripting	Patched	CVE-2022-27231	6.1	Shogo Kumamaru	May 24, 2022
WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting	Patched	CVE-2022-1005	6.1	Taurus Omar	May 11, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation