CVE-2020-20626
An authenticated stored Cross-Site Scripting (XSS) vulnerability within the "Google Analytics – by Lara" WordPress plugin was found to be exploited in the wild by security vendor NinTechNet.
Source: WPScan
PLUGIN SECURITY
Is Lara's Google Analytics (GA4) safe?
Full width Google Analytics dashboard widget for Wordpress admin interface, which also inserts latest Google Analytics (GA4) tracking code to your pag …
What this plugin does
- Slug:
lara-google-analytics - Author: Amr M. Ibrahim
- 9000+ active installs
- 94/100 rating (122 reviews on wordpress.org)
- 354843 all-time downloads
- On WordPress.org since 2016-04-26
analyticsgoogle analyticsgoogle analytics dashboardgoogle analytics plugingoogle analytics widget
Maintenance status
- Last updated: 2026-06-03 5:39pm GMT
- Tested up to WordPress: 7.0.2
- Requires PHP: 5.6.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
1 known CVE on file for Lara's Google Analytics (GA4). Reported between 2019 and 2019.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2020-20626 | Lara's Google Analytics (GA4) [lara-google-analytics] < 2.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.0.5 | 2.0.5 | 2019-10-14 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Site Kit by Google – Analytics, Search Console, AdSense, Speed — 5000000+ active installs — 84/100 (1006) — max PHP 8.4
- MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) — 2000000+ active installs — 90/100 (3145) — max PHP 8.4
- GTM4WP – A Google Tag Manager (GTM) plugin for WordPress — 700000+ active installs — 90/100 (154) — max PHP 8.4
- WP Statistics – Simple, privacy-friendly Google Analytics alternative — 600000+ active installs — 82/100 (757) — max PHP <8.0
- GA Google Analytics – Connect Google Analytics to WordPress — 400000+ active installs — 98/100 (158) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.