Koko Analytics – Privacy-Friendly WordPress Analytics

Koko Analytics – Privacy-Friendly WordPress Analytics has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 2 issues recorded for Koko Analytics – Privacy-Friendly WordPress Analytics has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Koko Analytics – Privacy-Friendly WordPress Analytics is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Koko Analytics – Privacy-Friendly WordPress Analytics vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-22850

Koko Analytics <= 2.1.2 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

2 records
Koko Analytics – Privacy-Friendly WordPress Analytics banner
Latestv2.5.2

Koko Analytics – Privacy-Friendly WordPress Analytics

Danny van Kooten

Author

Danny van Kooten

5.0(242)
100/100
Last Updated
2026-08-31 (13d ago)
Active Installs
60,000+
Downloads
2,461,668
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2019-11-05 (7y ago)

Koko Analytics is a privacy-friendly and lightweight Google Analytics alternative for WordPress sites. It is a plug and play solution to get GDPR compliant insights into your website visitors without requiring any third-party services. Why choose Koko Analytics? Important insights Koko Analytics provides you with simple and effective analytics. There are no complicated reports to dig through. All the important metrics are visible from a quick glance at your analytics dashboard, right inside your WordPress admin. Privacy-friendly analytics Koko Analytics is a privacy-friendly solution for WordPress. It can be used without any cookies, no personal data is processed or stored and nothing is shared with any third-party. That makes it suitable for GDPR, CCPA, and PECR-compliant website statistics. Lightweight website statistics Koko Analytics is lightweight. It adds less than 1 kilobyte of data to your pages and is fully compatible with all kinds of caching setups. WordPress is bypassed entirely for its collection endpoint, making the impact on your site’s performance as close to zero as possible. Open source analytics Koko Analytics is open source released under the GPL license, just like WordPress itself. The source code is publicly available. Everyone has the right to run, study, share or modify the source code. Features WordPress analytics dashboard – View your website statistics directly inside WordPress admin. Top posts and pages – See which content gets the most visits. Referrer statistics – Find out which websites send traffic to your site. Path-based tracking – Track statistics for any URL, including archives and search pages. Returning visitor detection – Reliably detect returning visitors without cookies. Exclusion rules – Exclude visits from selected WordPress user roles or IP addresses. Historical data imports – Import statistics from Jetpack Stats, Plausible Analytics, Burst Statistics, Statify, WP Statistics, Independent Analytics, or SlimStat Analytics. Automatic data cleanup – Remove historical data older than a chosen number of months or years. Popular posts output – Show your most visited posts or pages with a widget, Gutenberg block, or shortcode. Pageview counter – Show the total number of pageviews for a page with a shortcode or Gutenberg block. Koko Analytics Pro Koko Analytics Pro adds more reporting options for sites that need deeper analytics. Country statistics – See which countries your visitors come from. Technology reports – View browser, operating system, and device statistics. Email reports – Receive periodic analytics reports in your inbox. UTM Campaigns – Measure the performance of your marketing campaigns. Custom event tracking – Track outbound link clicks, contact form submissions, add-to-cart actions, and more. Traffic spike alerts – Get notified by email when traffic changes quickly. View the Koko Analytics live demo or see Koko Analytics Pro pricing.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C