Track Everything
Track Everything has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Track Everything has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by johska. Track Everything is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.5.2.
CVE-2025-53332Track Everything <= 2.0.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
Track Everything
Author
ethoseo
Track Everything makes event tracking simple. By default the plugin tracks form submissions, external links and emails. However, you can customize it to track nearly any common event using CSS selectors. The plugin allows users to label events or completely customize events’ Category, Action , and Label as allowed by Analytics. By using Google Analytics Event Tracking you can get a more detailed view of what users do on your site and track beyond what Google Analytics offers by default. WordPress Track Everything acts as a simple interface for jQuery Track Everything, allowing anyone to easily track events on their WordPress website.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C