Search Analytics for WP – Site Search Tracking
Search Analytics for WP – Site Search Tracking has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 5.7, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 6 issues recorded for Search Analytics for WP – Site Search Tracking has a vendor fix available, so running the current release closes all known holes.
6 independent researchers contributed these findings, one record each. Search Analytics for WP – Site Search Tracking is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-7444Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Search Analytics for WP – Site Search Tracking
Author
Cornel Raiu
Search Analytics for WP logs what visitors search for on your WordPress site and how many results each search returned. You see which search terms are popular and which came up empty. Everything is stored in your own database. Your site search shows what people came for, in their words rather than yours. Say “opening hours” got 41 searches last month and zero results every time. Either the page is missing or it says “business hours”. The no-results filter lists every gap like that. What your search log tells you What to write next. Searches with no results are topics people expect to find on your site. Sorted by number of searches, they become a to-do list with the most requested topics on top. On a blog, that’s your next post. In a help center, it’s the answer people keep missing. Which pages people can’t find. Sometimes the page exists and visitors still search for it. If “contact” or “shipping” shows up week after week, the link is probably too hard to spot. In a WooCommerce shop, every product search is saved with the number of products it found. A run of searches for a brand or size you don’t carry is demand you’d otherwise never hear about. Often the lesson is simply vocabulary. Visitors type “couch” when your store says “sofa”. Their search terms are the words to use in your titles and menus. Key features Records searches from your normal WordPress search, including theme search boxes and the WooCommerce product search. Also covers wpForo forum searches and custom URL parameters you add, such as Toolset’s wpv_post_search, including REST API requests that use them. AJAX live search can be recorded too, with one line of code (see For developers). Every search term in a sortable table, with the number of searches, average results and last search date. Time filters from the last 24 hours to all time, or any date range you pick. A no-results filter that shows only the searches that found nothing. Each term’s history by date or by hour, plus a “No Group” view that lists every search in order. A daily chart compared with the previous period, and a dashboard widget with last week’s numbers. CSV export of whatever view you’re on. Keep your own searches out, even after you log out. You can also skip repeat searches, listed IP addresses, very short terms and words you block. Optional country and logged-in user for each search, both off by default. Two shortcodes to show popular or recent searches on your site. Separate role access for viewing the statistics and changing the settings. Works on multisite, with separate data for each site, and is translation-ready. Getting started Recording starts as soon as you activate the plugin. Run a search on your site, then open Search Analytics in the admin menu to see it. One setting is worth changing on day one: exclude your own role, so your test searches don’t count. The FAQ below covers the rest, from WooCommerce to live search. Privacy There’s no account to create and no API key. Nothing is sent anywhere unless you turn on “Save Search Country”, which is off by default. It sends visitors’ IP addresses to ip-api.com or ip2c.org to look up the country (see External services below). IP addresses are never saved with the searches, and no cookies are set unless you use one of two optional settings. The FAQ lists exactly what is stored. For developers To record searches from your own code, such as an AJAX live search, call mwtsa_process_search_term( $term, $result_count ). It runs the same exclusion checks as a normal search and returns whether the search was saved. Filters: mwtsa_do_not_save_search, mwtsa_exclude_term, mwtsa_extra_exclude_conditions, mwtsa_result_count, mwtsa_export_filename, plus filters on the shortcode output. Actions: mwtsa_after_term_save, mwtsa_after_history_term_save. The code is on GitHub. Support Questions and ideas are welcome in the support forum. If the plugin is useful to you, a review helps other site owners find it. External services Search Analytics for WP can look up the country each search was made from. This only happens when the “Save Search Country” setting is enabled; it is off by default. When a search is recorded, the visitor’s IP address is sent to the service chosen in the “Country lookup service” setting. Each IP address is looked up at most once per day, and private or reserved addresses are never sent. IP-API (ip-api.com) The default service. The IP address is sent over HTTP, as the free service does not support HTTPS. The free service only allows non-commercial use and 45 requests per minute. Terms of service and privacy policy: https://ip-api.com/docs/legal ip2c.org The IP address is sent over HTTPS. The service is free (LGPL) and allows around 10 requests per second. It only supports IPv4 addresses, so searches from IPv6 addresses are saved without a country. Service terms and privacy policy: https://about.ip2c.org Credits Country flags on Windows use the “Twemoji Country Flags” font from country-flag-emoji-polyfill by TalkJS (MIT license). The flag artwork comes from Twemoji and is licensed under CC-BY 4.0. The font and polyfill are bundled with the plugin and loaded from your own site.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C