PLUGIN SECURITY
Is Wp Statistics safe?
Get website traffic insights with GDPR/CCPA compliant, privacy-friendly analytics. Includes visitor data, stunning graphs, and no data sharing.
What this plugin does
- Slug:
wp-statistics - Author: VeronaLabs
- 600000+ active installs
- 82/100 rating (757 reviews on wordpress.org)
- 36910833 all-time downloads
- On WordPress.org since 2011-03-20
analyticsgoogle analyticsinsightssite visitorsstats
Maintenance status
- Latest known version: 14.16.10
- Last updated: 2026-08-22 4:39pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
32 known CVEs on file for Wp Statistics.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-16562 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.16.10 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 14.16.10 | 14.16.10 | 2026-08-08 | ✓ fixed in latest |
| CVE-2026-15780 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.16.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 14.16.9 | 14.16.9 | 2026-06-01 | ✓ fixed in latest |
| CVE-2026-5231 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.16.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 14.16.5 | 14.16.5 | 2026-04-16 | ✓ fixed in latest |
| CVE-2026-3488 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.16.5 | Missing Authorization | Medium 6.5 | < 14.16.5 | 14.16.5 | 2026-04-16 | ✓ fixed in latest |
| CVE-2026-48839 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.16.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 14.16.7 | 14.16.7 | 2026-04-16 | ✓ fixed in latest |
| CVE-2025-55716 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.15.2 | Missing Authorization | Medium 4.3 | < 14.15.2 | 14.15.2 | 2025-08-14 | ✓ fixed in latest |
| CVE-2024-2194 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.5.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 14.5.1 | 14.5.1 | 2024-03-11 | ✓ fixed in latest |
| CVE-2023-0955 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 14.0 | 14.0 | 2023-03-06 | ✓ fixed in latest |
+ 67 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-38074 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.9 | < 13.2.11 | 13.2.11 | 2023-01-31 | ✓ fixed in latest |
| CVE-2022-4230 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.9 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 13.2.9 | 13.2.9 | 2022-12-27 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6 | — | Unknown | < 13.2.6 | 13.2.6 | 2022-09-08 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.6 | — | Unknown | < 13.2.6 | 13.2.6 | 2022-09-07 | ✓ fixed in latest |
| CVE-2022-27231 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 13.2.2 | 13.2.2 | 2022-05-24 | ✓ fixed in latest |
| CVE-2022-1005 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 13.2.2 | 13.2.2 | 2022-05-10 | ✓ fixed in latest |
| CVE-2022-25307 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 13.1.6 | 13.1.6 | 2022-02-17 | ✓ fixed in latest |
| CVE-2022-0651 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 13.1.6 | 13.1.6 | 2022-02-16 | ✓ fixed in latest |
| CVE-2022-25148 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 13.1.6 | 13.1.6 | 2022-02-16 | ✓ fixed in latest |
| CVE-2022-25149 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 13.1.6 | 13.1.6 | 2022-02-16 | ✓ fixed in latest |
| CVE-2022-25305, CVE-2022-25306, CVE-2022-25307 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 13.1.6 | 13.1.6 | 2022-02-16 | ✓ fixed in latest |
| CVE-2022-25306 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 13.1.6 | 13.1.6 | 2022-02-16 | ✓ fixed in latest |
| CVE-2022-0513 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 13.1.5 | 13.1.5 | 2022-02-10 | ✓ fixed in latest |
| CVE-2021-4333 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.2 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 13.1.2 | 13.1.2 | 2021-09-11 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1 | — | Unknown | < 13.1 | 13.1 | 2021-08-30 | ✓ fixed in latest |
| CVE-2021-24340 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.0.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 13.0.8 | 13.0.8 | 2021-05-19 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.0.8 | — | Unknown | < 13.0.8 | 13.0.8 | 2021-05-18 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7 | — | Unknown | < 12.6.7 | 12.6.7 | 2019-07-04 | ✓ fixed in latest |
| CVE-2019-13275 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 12.6.7 | 12.6.7 | 2019-07-01 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7 | — | Unknown | < 12.6.7 | 12.6.7 | 2019-07-01 | ✓ fixed in latest |
| CVE-2019-12566 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 12.6.6.1 | 12.6.6.1 | 2019-05-31 | ✓ fixed in latest |
| CVE-2019-10864 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 12.6.4 | 12.6.4 | 2019-04-09 | ✓ fixed in latest |
| CVE-2018-1000556 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] >= 12.0.2 - <= 12.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | 12.0.2–12.0.5 | 12.0.5 | 2018-06-26 | ✓ fixed in latest |
| CVE-2017-10991 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 12.0.10 | 12.0.10 | 2017-07-07 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9 | — | Unknown | < 12.0.9 | 12.0.9 | 2017-07-03 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.8 | — | Unknown | < 12.0.8 | 12.0.8 | 2017-07-01 | ✓ fixed in latest |
| CVE-2017-18515 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 12.0.8 | 12.0.8 | 2017-06-30 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.6 | — | Unknown | < 12.0.6 | 12.0.6 | 2017-04-28 | ✓ fixed in latest |
| CVE-2017-2147 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] <= 12.0.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 12.0.4 | 12.0.4 | 2017-04-13 | ✓ fixed in latest |
| CVE-2017-2136 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 12.0.5 | 12.0.5 | 2017-04-13 | ✓ fixed in latest |
| CVE-2017-2135 | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 12.0.5 | 12.0.5 | 2017-04-10 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1 | — | Unknown | < 9.4.1 | 9.4.1 | 2015-11-22 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2 | — | Unknown | < 9.5.2 | 9.5.2 | 2015-08-10 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2 | — | Unknown | < 9.5.2 | 9.5.2 | 2015-08-10 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1 | — | Unknown | < 9.4.1 | 9.4.1 | 2015-07-09 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5 | — | Unknown | < 2.2.5 | 2.2.5 | 2015-06-25 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3 | — | Unknown | < 9.1.3 | 9.1.3 | 2015-05-15 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1 | — | Unknown | < 8.3.1 | 8.3.1 | 2015-05-15 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5 | — | Unknown | < 8.5 | 8.5 | 2015-05-15 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3 | — | Unknown | < 9.1.3 | 9.1.3 | 2015-04-15 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5 | — | Unknown | < 8.5 | 8.5 | 2014-12-03 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1 | — | Unknown | < 8.3.1 | 8.3.1 | 2014-11-20 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5 | — | Unknown | < 2.2.5 | 2.2.5 | 2012-05-15 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.13.4 | Missing Authorization | Medium 6.5 | < 14.13.4 | 14.13.4 | 0000-00-00 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 14.15.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 14.15.5 | 14.15.5 | 0000-00-00 | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1 | — | Unknown | < 13.1 | 13.1 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.6.7 | — | Unknown | < 12.6.7 | 12.6.7 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 12.0.9 | — | Unknown | < 12.0.9 | 12.0.9 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.5.2 | — | Unknown | < 9.5.2 | 9.5.2 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.4.1 | — | Unknown | < 9.4.1 | 9.4.1 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 9.1.3 | — | Unknown | < 9.1.3 | 9.1.3 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.5 | — | Unknown | < 8.5 | 8.5 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 8.3.1 | — | Unknown | < 8.3.1 | 8.3.1 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 2.2.5 | — | Unknown | < 2.2.5 | 2.2.5 | — | ✓ fixed in latest |
| — | WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 | — | Unknown | < 13.1.6 | 13.1.6 | — | ✓ fixed in latest |
| — | WP Statistics <= 2.2.4 - Cross-Site Scripting (XSS) | — | Unknown | < 2.2.5 | 2.2.5 | — | ✓ fixed in latest |
| — | WP Statistics <= 8.3 - Stored & Reflected Cross-Site Scripting (XSS) | — | Unknown | < 8.3.1 | 8.3.1 | — | ✓ fixed in latest |
| — | WP Statistics <= 8.4 - Unauthenticated Referer Header Stored XSS | — | Unknown | < 8.5 | 8.5 | — | ✓ fixed in latest |
| — | WP Statistics <= 9.1.2 - Authenticated Stored Cross-Site Scripting (XSS) | — | Unknown | < 9.1.3 | 9.1.3 | — | ✓ fixed in latest |
| — | WP Statistics <= 9.4 - Authenticated SQL Injection | — | Unknown | < 9.4.1 | 9.4.1 | — | ✓ fixed in latest |
| — | WP Statistics <= 9.5.1 - Referer Cross-Site Scripting (XSS) | — | Unknown | < 9.5.2 | 9.5.2 | — | ✓ fixed in latest |
| — | WP Statistics < 12.0.9 - Authenticated Reflected Cross-Site Scripting (XSS) | — | Unknown | < 12.0.9 | 12.0.9 | — | ✓ fixed in latest |
| — | WP Statistics < 12.6.7 - Unauthenticated Stored XSS Under Certain Configurations | — | Unknown | < 12.6.7 | 12.6.7 | — | ✓ fixed in latest |
| — | WP Statistic < 13.1 - Reflected Cross-Site Scripting (XSS) | — | Unknown | < 13.1 | 13.1 | — | ✓ fixed in latest |
| — | WP Statistic < 13.1.6 - Reflected Cross-Site Scripting | — | Unknown | < 13.1.6 | 13.1.6 | — | ✓ fixed in latest |
| CVE-2025-3953 | WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin < 14.13.4 - Subscriber+ Arbitrary Plugin Settings Update | — | Unknown | < 14.13.4 | 14.13.4 | — | ✓ fixed in latest |
| CVE-2025-9816 | WP Statistics < 14.15.5 - Unauthenticated Stored XSS via User-Agent Header | — | Unknown | < 14.15.5 | 14.15.5 | — | ✓ fixed in latest |
How to fix it
Keep Wp Statistics updated — 14.16.10 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Site Kit by Google – Analytics, Search Console, AdSense, Speed — 5000000+ active installs — 84/100 (1009)
- MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) — 2000000+ active installs — 90/100 (3148) — max PHP 8.4
- GTM4WP – A Google Tag Manager (GTM) plugin for WordPress — 700000+ active installs — 90/100 (154) — max PHP 8.4
- GA Google Analytics – Connect Google Analytics to WordPress — 400000+ active installs — 98/100 (158) — max PHP 8.4
- ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) — 300000+ active installs — 50/100 (1547)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.