Stetic

Stetic has one disclosed vulnerability in the WordSec catalog, all reported in 2021; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Stetic has a vendor fix available, so running the current release closes it.

All of these findings were reported by Naoki Ogawa, Cryptography Laboratory in Tokyo Denki University. Stetic is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

8.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Stetic vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2021-42364

Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2021-11-29 00:00	Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting Stetic <= 1.0.6	`CVE-2021-42364`	8.8 High	Naoki Ogawa, Cryptography Laboratory in Tokyo Denki University	Yes

Showing 1–1 of 1 reports

Latestv1.0.15

Stetic

Author

stetic

5.0(1)

100/100

Last Updated

2026-06-06 (3mo ago)

Active Installs

100+

Downloads

6,183

Requires WP

5.0+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2015-04-08 (12y ago)

Stetic is the Google Analytics alternative without cookies and offers simple, privacy-friendly web analytics since 2004. No cookie banner necessary. Real Time Web Analytics Use the popular Stetic Web Analytics on your WordPress blog. Just enter your project token and api key and the Stetic tracking code will be automaticly be added to your site. Now you can watch your stats on the wordpress dashboard and on the Stetic plugin statistics page. Use of 3rd Party and external service You have to be registered with Stetic (URL: https://www.stetic.com/) to use this plugin. Data is send to and retrieved from Stetic servers. For the terms of use and privacy policies from Stetic, please visit the following URL’s: https://www.stetic.com/terms/ https://www.stetic.com/privacy/ Features Ads the Stetic Tracking Code to your blog You can choose the Hidden Counter Option WordPress Dashboard: Todays performance graph and numbers: Visitors, Page Impressions, Pages/Visit, Time on Site Stetic Dashboard page Stetic Dashboard page Todays performance graph Statictic numbers (Visits, PI’s and so on) for Today, Yesterday, This month, Last month, This year and Total Performance Graph for last 31 days Performance Graph for this year Site Stats Keyword Stats Referrer Stats Browser Stats OS Stats Screen Stats Visitor log of the last 25 visitors

View on WordPress.org