Universal Analytics
Universal Analytics has one disclosed vulnerability in the WordSec catalog, all reported in 2016; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Universal Analytics has a vendor fix available, so running the current release closes it.
Universal Analytics is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.
CVE-2016-10912Universal Analytics <= 1.3.0 - Cross-Site Scripting
Read the full analysisVulnerability Records

Universal Analytics
Author
Cullen Whitmore
With Google’s Universal Analytics officialy out of beta, there is no better time to start using Universal Analytics. This plugin provides a simple method for you to add the analytics snippet to your website. All you need to do is paste your Tracking ID into the field and press save. There are a few advanced options as well. Determine if you wan the snippet in the head or footer Track events such as downloads, mailto, & outbound links Enable Display Advertising (Remarketing & Demographics) Anonymize IP addresses Disable tracking for administrators …and more to come. If you don’t already have your Tracking ID or for more information about Universal Analytics visit: Google Analytics We would like to give special credit to Audrius Dobilinskas. Our plugin is based on his version of Google Universal Analytics which provides several more advanced features as well as being able to use the “Classic” version of Google Analytics as well as being able to add your own custom snippets. Our version of Universal Analytics has been modified and trimmed down to meet our specific needs and supports integration with Launch Check. If you’re not familiar with it, Launch Check ensures you have made your site visible to search engines, changed the default description and added Google Analytics before launch.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C