Piwik PRO
Piwik PRO has one disclosed vulnerability in the WordSec catalog, all reported in 2009; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 1 of the records (100%).
The one issue recorded for Piwik PRO has a vendor fix available, so running the current release closes it.
Piwik PRO is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2009-4140Various Affected Software (Various Versions) - Arbitrary File Upload
Read the full analysisVulnerability Records

Piwik PRO
Author
Piwik PRO
A simple plugin to add the Piwik PRO Analytics Suite container (with tracking code) to your WordPress site, making it easy to collect visitor data from any WordPress site and automatically track ecommerce in your WooCommerce store. You’ll also be able to manage consents and run tags after using this plugin. What is Piwik PRO? Piwik PRO is a privacy-first platform that provides advanced web and app analytics features while enabling full control over data. It provides flexible reports and data collection in addition to consent management, tag management and a customer data platform. Analytics Collect data across websites, apps, digital products and post-login areas. Customize how data is collected and analyze it with built-in audience, behavior, acquisition and conversion reports. Dive deeper with custom reports and access to raw data. Tag Manager Add flexible tags to your analytics stack without hiring an IT team to do it. Quickly create, test and deploy tags from templates or with custom code. Coordinate tag behavior with Analytics, Customer Data Platform and Consent Manager to fit any data collection approach. Data Activation Build customer profiles, segment audiences and create insightful single customer views. Quickly populate the profiles using data collected with the help of Analytics and Tag Manager. Set up Consent Manager so data is only collected data when there is specific consent for it. Consent Manager Manage consents and data subject requests in the same platform where data is collected and processed. Categorize data from Analytics and Tag Manager so that the data collected always agrees with the consent received.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C