Simple Blog Stats

Simple Blog Stats has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Simple Blog Stats has a vendor fix available, so running the current release closes it.

All of these findings were reported by Muhammad Yudha - DJ. Simple Blog Stats is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Simple Blog Stats vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-47499

Simple Blog Stats <= 20250416 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Simple Blog Stats banner
Latestv20260809

Simple Blog Stats

Jeff Starr

Author

Jeff Starr

4.9(38)
98/100
Last Updated
2026-08-09 (1mo ago)
Active Installs
4,000+
Downloads
169,497
Requires WP
4.7+
Requires PHP
5.6.20+
Tested up to
WP 7.1
Created
2012-11-17 (14y ago)

Simple Blog Stats (SBS) provides shortcodes and tags to display site statistics in posts, pages, and anywhere in your theme. Displays a wealth of useful statistics about your site. Display total number of posts, pages, categories, tags, and much more. Display Statistics Total number of posts Total number of pages Total number of drafts Total number of comments Total number of media files (any types) Number of comments in moderation Number of approved comments Number of registered users Number of categories Number of tags Number of words for any post Number of words for all posts Display all blog stats in a list Display number of posts for any Custom Post Type Display list of counts for all Custom Post Types Display current number of logged-in users Display number of logged-in users via Dashboard widget Display number of words in any custom field Plugin Features Uses caching for better performance Provides shortcodes to display stats in Posts and Pages Provides template tags to display stats anywhere in your theme Configure text/markup to appear before/after each shortcode Built with the WP API for optimal performance and security Provides slick settings screen with toggling panels Provides option to restore default plugin settings Displays your stats with clean, valid markup Works with or without Gutenberg Block Editor Plugin is regularly updated and “future proof” Display list of stats via Dashboard widget More Statistics Display date of most recent site update Display list of recent posts (configurable) Display list of recent comments (configurable) Display number of users per role (configurable) Display all blog stats in a nicely formatted list Configure all shortcodes via the plugin settings Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. Simple Blog Stats is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C