CAOS | Host Google Analytics Locally

CAOS | Host Google Analytics Locally has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2023; all 2 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 6.5 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include Path Traversal.

Every one of the 2 issues recorded for CAOS | Host Google Analytics Locally has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. CAOS | Host Google Analytics Locally is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.7/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all CAOS | Host Google Analytics Locally vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2023-6637

CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update

Read the full analysis

Vulnerability Records

2 records
CAOS | Host Google Analytics Locally banner
Latestv5.0.3

CAOS | Host Google Analytics Locally

Daan van den Bergh

Author

Daan van den Bergh

4.9(128)
98/100
Last Updated
2026-06-04 (3mo ago)
Active Installs
10,000+
Downloads
2,039,636
Requires WP
4.6+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2016-05-06 (11y ago)

CAOS can be downloaded for free without any paid subscription from the official WordPress repository. CAOS (Complete Analytics Optimization Suite) for Google Analytics allows you to host gtag.js locally and keep it updated using WordPress’ built-in Cron-schedule. Fully automatic! Not a big Google Analytics user and just curious about your pageviews? CAOS fully supports Minimal Analytics 4. An extremely lightweight alternative to Google Analytics’ default libraries (gtag.js). Minimal Analytics also helps you get rid of that annoying Unused JS notice in Google PageSpeed Insights! Whenever you run an analysis of your website on Google Pagespeed Insights, Pingdom or GTMetrix, it’ll tell you to leverage browser cache when you’re using Google Analytics. Because Google has set the cache expiry time to 2 hours. This plugin will get you a higher score on Pagespeed and Pingdom and make your website load faster, because the user’s browser doesn’t have to make a roundtrip to download the file from Google’s external server. Just install the plugin, enter your Measurement ID and the plugin adds the necessary Tracking Code for Google Analytics 4 to the header (or footer) of your theme, downloads and saves the gtag.js-file to your website’s server and keeps it updated (automagically) using a scheduled script in wp_cron(). Or if you’d like to use the locally hosted file with another plugin, check Compatibility Mode under Advanced Settings, Either way, CAOS is a set and forget plugin. For more information: [How to setup CAOS](For more information: How to setup CAOS. Features Host gtag.js for Google Analytics 4 locally, Downloaded files are renamed to random strings to avoid ad blockers, Minimal Analytics 4 support, Compatibility Mode allows you to use the locally hosted file with all Google Analytics plugins, e.g. MonsterInsights (Pro), ExactMetrics Site Kit by Google, WooCommerce Google Analytics Integration, WooCommerce Google Analytics Pro, Analytify, And many more! Compatible with all Cookie Notice plugins, e.g. Complianz, CookieYes, WP Cookie Notice, Cookie Notice & Compliance, Cookie Notice & Consent Banner, And many more! Preconnect to google-analytics.com to reduce latency and speed up requests, Add tracking code to header, footer or manually, Save gtag.js anywhere within the WordPress content (wp-content) directory to avoid detection by WordPress security plugins (such as WordFence) or removal by caching plugins (such as WP Super Cache), Serve gtag.js from your CDN, Set Cookie Expiry Period, Force disabling display features functionalities, Track logged in Administrators, Features in CAOS Pro Use Google Analytics in compliance with GDPR with: – Randomize Client ID (which grants a fresh, untraceable UUID/ClientID to each visitor), – Stealth Mode (a unique, customized API, designed for WordPress, which anonymizes your visitor’s data before sending it to Google’s servers). Other features: – Cloaked Affiliate Link Tracking, – Cloudflare Compatibility Mode.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C