¿Es seguro Wp Statistics?

Qué hace este plugin

• Slug: wp-statistics
• 600000+ instalaciones activas

analyticsgoogle analyticsinsightssite visitorsstats

Estado de mantenimiento

• Última versión conocida: 14.16.8
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

30 CVEs conocidos registrados para Wp Statistics.

CVE-2026-48839

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 14.16.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-5231

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer later inserts this value into legend markup via innerHTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in admin pages that will execute whenever an administrator accesses the Referrals Overview or Social Media analytics pages.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-3488

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including `wp_statistics_get_filters`, `wp_statistics_getPrivacyStatus`, `wp_statistics_updatePrivacyStatus`, and `wp_statistics_dismiss_notices`. These endpoints only verify a `wp_rest` nonce via `check_ajax_referer()` but do not enforce any capability checks such as `current_user_can()` or the plugin's own `User::Access()` method. Since the `wp_rest` nonce is available to all authenticated WordPress users, this makes it possible for authenticated attackers, with Subscriber-level access and above, to access sensitive analytics data (user IDs, usernames, emails, visitor tracking data), retrieve and modify privacy audit compliance status, and dismiss administrative notices.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-55716

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 14.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-2194

Update the WordPress WP Statistics plugin to the latest available version (at least 14.5.1). Tim Coen discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Statistics Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 14.5.1. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-0955

The WP Statistics plugin for WordPress is vulnerable to SQL Injection via the $days_time_list value in versions up to, and including, 13.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-38074

The WP Statistics plugin for WordPress is vulnerable to SQL Injection via the ‘limit’ parameter in versions up to, and including, 13.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscriber-level attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-4230

The WP Statistics plugin for WordPress is vulnerable to SQL Injection via the $search_engine value in versions up to, and including, 13.2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 64 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6	—	Desconocido	< 13.2.6	13.2.6	2022-09-08	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6	—	Desconocido	< 13.2.6	13.2.6	2022-09-07	✓ corregido en la última versión
CVE-2022-27231	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 13.2.2	13.2.2	2022-05-24	✓ corregido en la última versión
CVE-2022-1005	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 13.2.2	13.2.2	2022-05-10	✓ corregido en la última versión
CVE-2022-25307	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 13.1.6	13.1.6	2022-02-17	✓ corregido en la última versión
CVE-2022-0651	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 13.1.6	13.1.6	2022-02-16	✓ corregido en la última versión
CVE-2022-25148	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 13.1.6	13.1.6	2022-02-16	✓ corregido en la última versión
CVE-2022-25149	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 13.1.6	13.1.6	2022-02-16	✓ corregido en la última versión
CVE-2022-25305, CVE-2022-25306, CVE-2022-25307	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 13.1.6	13.1.6	2022-02-16	✓ corregido en la última versión
CVE-2022-25306	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 13.1.6	13.1.6	2022-02-16	✓ corregido en la última versión
CVE-2022-0513	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.5	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 13.1.5	13.1.5	2022-02-10	✓ corregido en la última versión
CVE-2021-4333	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.2	Falsificación de petición en sitios cruzados (CSRF)	Media 6,5	< 13.1.2	13.1.2	2021-09-11	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1	—	Desconocido	< 13.1	13.1	2021-08-30	✓ corregido en la última versión
CVE-2021-24340	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.0.8	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 13.0.8	13.0.8	2021-05-19	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.0.8	—	Desconocido	< 13.0.8	13.0.8	2021-05-18	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7	—	Desconocido	< 12.6.7	12.6.7	2019-07-04	✓ corregido en la última versión
CVE-2019-13275	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 12.6.7	12.6.7	2019-07-01	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7	—	Desconocido	< 12.6.7	12.6.7	2019-07-01	✓ corregido en la última versión
CVE-2019-12566	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.6.1	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 12.6.6.1	12.6.6.1	2019-05-31	✓ corregido en la última versión
CVE-2019-10864	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.4	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 12.6.4	12.6.4	2019-04-09	✓ corregido en la última versión
CVE-2018-1000556	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] >= 12.0.2 - <= 12.0.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	12.0.2–12.0.5	12.0.5	2018-06-26	✓ corregido en la última versión
CVE-2017-10991	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.10	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 12.0.10	12.0.10	2017-07-07	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9	—	Desconocido	< 12.0.9	12.0.9	2017-07-03	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.8	—	Desconocido	< 12.0.8	12.0.8	2017-07-01	✓ corregido en la última versión
CVE-2017-18515	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.8	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 12.0.8	12.0.8	2017-06-30	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.6	—	Desconocido	< 12.0.6	12.0.6	2017-04-28	✓ corregido en la última versión
CVE-2017-2147	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] <= 12.0.4	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 12.0.4	12.0.4	2017-04-13	✓ corregido en la última versión
CVE-2017-2136	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 12.0.5	12.0.5	2017-04-13	✓ corregido en la última versión
CVE-2017-2135	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 12.0.5	12.0.5	2017-04-10	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1	—	Desconocido	< 9.4.1	9.4.1	2015-11-22	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2	—	Desconocido	< 9.5.2	9.5.2	2015-08-10	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2	—	Desconocido	< 9.5.2	9.5.2	2015-08-10	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1	—	Desconocido	< 9.4.1	9.4.1	2015-07-09	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5	—	Desconocido	< 2.2.5	2.2.5	2015-06-25	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3	—	Desconocido	< 9.1.3	9.1.3	2015-05-15	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1	—	Desconocido	< 8.3.1	8.3.1	2015-05-15	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5	—	Desconocido	< 8.5	8.5	2015-05-15	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3	—	Desconocido	< 9.1.3	9.1.3	2015-04-15	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5	—	Desconocido	< 8.5	8.5	2014-12-03	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1	—	Desconocido	< 8.3.1	8.3.1	2014-11-20	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5	—	Desconocido	< 2.2.5	2.2.5	2012-05-15	✓ corregido en la última versión
CVE-2025-3953	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.13.4	Falta de control de autorización	Media 6,5	< 14.13.4	14.13.4	0000-00-00	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.15.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,2	< 14.15.5	14.15.5	0000-00-00	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1	—	Desconocido	< 13.1	13.1	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7	—	Desconocido	< 12.6.7	12.6.7	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9	—	Desconocido	< 12.0.9	12.0.9	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2	—	Desconocido	< 9.5.2	9.5.2	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1	—	Desconocido	< 9.4.1	9.4.1	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3	—	Desconocido	< 9.1.3	9.1.3	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5	—	Desconocido	< 8.5	8.5	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1	—	Desconocido	< 8.3.1	8.3.1	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5	—	Desconocido	< 2.2.5	2.2.5	—	✓ corregido en la última versión
—	WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6	—	Desconocido	< 13.1.6	13.1.6	—	✓ corregido en la última versión
—	WP Statistics <= 2.2.4 - Cross-Site Scripting (XSS)	—	Desconocido	< 2.2.5	2.2.5	—	✓ corregido en la última versión
—	WP Statistics <= 8.3 - Stored & Reflected Cross-Site Scripting (XSS)	—	Desconocido	< 8.3.1	8.3.1	—	✓ corregido en la última versión
—	WP Statistics <= 8.4 - Unauthenticated Referer Header Stored XSS	—	Desconocido	< 8.5	8.5	—	✓ corregido en la última versión
—	WP Statistics <= 9.1.2 - Authenticated Stored Cross-Site Scripting (XSS)	—	Desconocido	< 9.1.3	9.1.3	—	✓ corregido en la última versión
—	WP Statistics <= 9.4 - Authenticated SQL Injection	—	Desconocido	< 9.4.1	9.4.1	—	✓ corregido en la última versión
—	WP Statistics <= 9.5.1 - Referer Cross-Site Scripting (XSS)	—	Desconocido	< 9.5.2	9.5.2	—	✓ corregido en la última versión
—	WP Statistics < 12.0.9 - Authenticated Reflected Cross-Site Scripting (XSS)	—	Desconocido	< 12.0.9	12.0.9	—	✓ corregido en la última versión
—	WP Statistics < 12.6.7 - Unauthenticated Stored XSS Under Certain Configurations	—	Desconocido	< 12.6.7	12.6.7	—	✓ corregido en la última versión
—	WP Statistic < 13.1 - Reflected Cross-Site Scripting (XSS)	—	Desconocido	< 13.1	13.1	—	✓ corregido en la última versión
—	WP Statistic < 13.1.6 - Reflected Cross-Site Scripting	—	Desconocido	< 13.1.6	13.1.6	—	✓ corregido en la última versión
CVE-2025-9816	WP Statistics < 14.15.5 - Unauthenticated Stored XSS via User-Agent Header	—	Desconocido	< 14.15.5	14.15.5	—	✓ corregido en la última versión

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6

The WP Statistics plugin for WordPress is vulnerable to time-based blind SQL Injection via the ‘agent’ parameter in versions up to, and including, 13.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6

The WP Statistics plugin for WordPress is vulnerable to information disclosure via the Metabox REST API in versions up to, and including, 13.2.5. This allows all authenticated users to access statistics generated by the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-27231

Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-1005

The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-25307

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-0651

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-25148

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-25149

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-25305, CVE-2022-25306, CVE-2022-25307

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-25306

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-0513

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-4333

The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1

The WP Statistic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 13.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24340

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.0.8

Unauthenticated Time-Based Blind SQL Injection (SQLi) vulnerability discovered by WordFence in WordPress WP Statistics plugin (versions <= 13.0.7).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability found by Antony Garand in WordPress WP Statistics plugin (version <= 12.6.6.1). The specific configuration needed for exploitation.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP spoofing in versions up to, and including, 12.6.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2019-12566

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2019-10864

The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2018-1000556

WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2017-10991

The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9

The WP Statistics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions before 12.0.9 due to insufficient input sanitization and output escaping on the IP parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.8

WordPress WP Statistic plugin in version 12.0.7 and earlier versions vulnerable to Authenticated SQL Injection vulnerability due to lack of sanitization in user-provided data. In this case users even with subscriber rights could use this vulnerability to steal sensitive data. The plugin already has a patched version. Please update the plugin to the latest possible version (at least WP Statistics 12.0.8).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2017-18515

The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.6

WordPress WP Statistics plugin v12.0.5 and earlier versions are vulnerable to Reflected Cross-Site Scripting (XSS) vulnerability. The value of the GET input “page-uri” is not sanitized, in the file /includes/log/page-statistics.php. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2017-2147

The WordPress plugin "WP Statistics" provided by WP Statistics contains a stored cross-site scripting vulnerability (CWE-79). Note that this vulnerability is different from JVN#62392065. Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: jvndb.jvn.jp

CVE-2017-2136

The WordPress plugin "WP Statistics" provided by WP Statistics contains a stored cross-site scripting vulnerability (CWE-79) in multiple pages due to a flaw in processing HTTP Referer headers. Note that this vulnerability is different from JVN#77253951. Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: jvndb.jvn.jp

CVE-2017-2135

The WordPress plugin "WP Statistics" provided by WP Statistics contains a reflected cross-site scripting vulnerability (CWE-79). ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: jvndb.jvn.jp

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Upgrade plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2

The WP Statistics plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 9.5.1 due to insufficient input sanitization and output escaping on the top-referrers page. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1

The WP Statistics plugin for WordPress is vulnerable to blind SQL Injection via the ‘page-id’ parameter in versions before 9.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers at the administrator-level role to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3

This plugin is prone to a cross site scripting vulnerability because "above" parameter is vulnerable to cross site scripting. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1

This plugin is prone to stored and reflected cross site scripting vulnerabilities. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5

This plugin is prone to unauthenticated referer header stored cross site scripting vulnerability. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Check for online users every:' & 'Coefficient per visitor:' fields in versions before 9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with admin-level privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the referer link in versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1

The WP Statistics plugin for WordPress is vulnerable to Multiple Cross-Site Scripting via several parameters in versions before 8.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5

The WP Statistics plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-3953

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.15.5

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1

The plugin does not sanitise and escape various user input before outputting it back in pages, which could lead to Cross-Site Scripting issues

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7

Unauthenticated stored XSS via the forwarded IP if the plugin has a certain configuration

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9

Version 12.0.8.1 and below of the WP Statistics WordPress Plugin was found to be vulnerable to Authenticated Reflected Cross-Site Scripting (XSS). The 'ip' GET parameter on the 'wps_visitors_page' page is output to a page without first being validated, sanitised or output encoded. This leads to Authenticated Reflected Cross-Site Scripting (XSS), which could allow attackers to compromise a WordPress application by tricking an authenticated administrator user into clicking on a specially crafted link. Please note that other potential instances of Authenticated XSS were identified, however, were protected by Cross-Site Request Forgery (CSRF) nonces. This issue was patched within hours by the vendor in version 12.0.9.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2

The WP Statistics WordPress plugin was affected by a Referer Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1

The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3

The WP Statistics WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5

On the "Statistics > Visitors" screen the referer link is not filtered. Malicious JavaScript can be injected by an unauthenticated user. This simple cURL command with a custom referer header makes it possible: curl -H 'Referer: javascript:alert(location.href);' 'http://wp.dev'

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1

The WP Statistics WordPress plugin was affected by a Stored & Reflected Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5

The WP Statistics WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6

The plugin does not escape various generated links before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Wp Statistics actualizado — 14.16.8 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Site Kit by Google – Analytics, Search Console, AdSense, Speed — 5000000+ instalaciones activas — 84/100 (1006) — PHP máx. 8.4
• MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) — 2000000+ instalaciones activas — 90/100 (3144) — PHP máx. 8.4
• GTM4WP – A Google Tag Manager (GTM) plugin for WordPress — 700000+ instalaciones activas — 90/100 (154) — PHP máx. 8.4
• GA Google Analytics – Connect Google Analytics to WordPress — 400000+ instalaciones activas — 98/100 (158) — PHP máx. 8.4
• ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) — 300000+ instalaciones activas — 50/100 (1546)