WP Statistics – Simple, privacy-friendly Google Analytics alternative

Explore WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities across all versions. Currently tracking 38 known vulnerabilities, including severity, impact, and patch status.

01234567891020.03.2011Today15.05.20126.1WP Statistics <= 2.2.4 - Cross-Site Scripting CVSS 6.1 · 15.05.201220.11.20147.2WP Statistics < 8.3.1 - Multiple Cross-Site Scripting CVSS 7.2 · 20.11.201403.12.20147.2WP Statistics <= 8.4 - Stored Cross-Site Scripting CVSS 7.2 · 03.12.201415.04.20155.5WP Statistics < 9.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 5.5 · 15.04.201509.07.20158.7WP Statistics < 9.4.1 - Authenticated Blind SQL Injection CVSS 8.7 · 09.07.201510.08.20156.1WP Statistics <= 9.5.1 - Cross-Site Scripting CVSS 6.1 · 10.08.201513.04.20176.1WP Statistics <= 12.0.4 - Stored Cross-Site Scripting CVSS 6.1 · 13.04.201730.06.20178.8WP Statistics <= 12.0.7 - Authenticated SQL Injection CVSS 8.8 · 30.06.201703.07.20176.1WP Statistics <= 12.0.8.1 - Reflected Cross-Site Scripting CVSS 6.1 · 03.07.201707.07.20176.1WP Statistics <= 12.0.9 - Authenticated Cross-Site Scripting CVSS 6.1 · 07.07.201709.04.20196.1WP Statistics <= 12.6.3 - Referer Cross-Site Scripting CVSS 6.1 · 09.04.201931.05.20196.4WP Statistics <= 12.6.5 - Stored Cross-Site Scripting CVSS 6.4 · 31.05.201901.07.20199.8WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection CVSS 9.8 · 01.07.20197.2WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP Manipulation CVSS 7.2 · 01.07.201919.05.20217.5WP Statistics <= 13.0.7 - Unauthenticated SQL Injection CVSS 7.5 · 19.05.202130.08.20216.1WP Statistics <= 13.0.9 - Reflected Cross-Site Scripting CVSS 6.1 · 30.08.202111.09.20216.5WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation CVSS 6.5 · 11.09.202110.02.20229.8WP Statistics <= 13.1.4 - Unauthenticated Blind SQL Injection CVSS 9.8 · 10.02.202216.02.20229.8WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type CVSS 9.8 · 16.02.20227.2WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP CVSS 7.2 · 16.02.20229.8WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP CVSS 9.8 · 16.02.20229.8WP Statistics <= 13.1.5 - Unauthenticated SQL Injection CVSS 9.8 · 16.02.20227.2WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser CVSS 7.2 · 16.02.202217.02.20227.2WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform CVSS 7.2 · 17.02.202211.05.20226.1WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting CVSS 6.1 · 11.05.202224.05.20226.1WP Statistics <= 13.1.7 - Cross-Site Scripting CVSS 6.1 · 24.05.202207.09.20224.3WP Statistics <= 13.2.5 - Information Disclosure CVSS 4.3 · 07.09.202208.09.20228.8WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 08.09.202227.12.20227.2WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection CVSS 7.2 · 27.12.202231.01.20238.8WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection CVSS 8.8 · 31.01.202306.03.20237.2WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection CVSS 7.2 · 06.03.202311.03.20247.2WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 11.03.202429.04.20255.4WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update CVSS 5.4 · 29.04.202514.08.20254.3WP Statistics <= 14.15 - Missing Authorization CVSS 4.3 · 14.08.202526.09.20257.2WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header CVSS 7.2 · 26.09.202516.04.20267.2WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter CVSS 7.2 · 16.04.20266.5WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation CVSS 6.5 · 16.04.202601.06.20267.2WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 01.06.2026

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage100%
Open

0

Fixed

38

Get automatic notifications for all WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities before they are exploited.

Vulnerability Records

38 records
2026-06-01 00:00CVE-2026-48839
7.2
High
darooYes
2026-04-16 13:23CVE-2026-3488
6.5
Medium
Jack Pas (Dark.)Yes
2026-04-16 13:20CVE-2026-5231
7.2
High
darooYes
2025-09-26 16:25CVE-2025-9816
7.2
High
Dmitrii IgnatyevYes
2025-08-14 00:00CVE-2025-55716
4.3
Medium
Denver JacksonYes
2025-04-29 00:00CVE-2025-3953
5.4
Medium
Trương Hữu Phúc (truonghuuphuc)Yes
2024-03-11 00:00CVE-2024-2194
7.2
High
Tim CoenYes
2023-03-06 00:00CVE-2023-0955
7.2
High
Erwan LRYes
2023-01-31 00:00CVE-2022-38074
8.8
High
Rafie MuhammadYes
2022-12-27 00:00CVE-2022-4230
7.2
High
Jordy VersmissenYes
Showing 1–10 of 38 reports
WP Statistics – Simple, privacy-friendly Google Analytics alternative banner
Latestv14.16.10

WP Statistics – Simple, privacy-friendly Google Analytics alternative

VeronaLabs

Author

VeronaLabs

4.1(757)
82/100
Last Updated
2026-07-25 (5d ago)
Active Installs
600,000+
Downloads
36,590,619
Requires WP
6.6+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2011-03-20 (16y ago)

Discover GDPR-compliant analytics with WP Statistics, the top choice for WordPress users seeking an alternative to Google Analytics. No external accounts, unlimited visitor tracking, and full data ownership—all stored directly in your WordPress database. Checkout Demo | View Screenshots GDPR Compliant (Data Privacy) WP Statistics is GDPR, CCPA, PECR, and cookie compliance by default. We do not use cookies We do not store personally identifiable information (PII) by default 100% data ownership. Data is entirely created and stored on your server Enhance IP Hashing with Random Daily Salt Mechanism Features to export and delete data for GDPR Respect for User Privacy with Do Not Track (DNT) Privacy Audit Tool for compliance with privacy laws Your site won’t need to have a cookie popup since WP Statistics uses cookie-less tracking. You can find more information in “What we collect“. Top Features Fully integrate with your WordPress and your content structure and you have the all reports all in your WP dashboard Content and Category Analytics: Track performance based on your site’s content and categories. Simple analytics dashboard Super easy to install. No coding or technical knowledge needed Advanced data privacy settings that are customizable to fit your needs, in compliance with diverse data protection laws Track URL parameters, including UTMs, for campaign analysis With configurable settings, manage large amounts of data on high-traffic websites Monitor live online user traffic in real-time Fully customized overview dashboard page Shows your most popular posts and pages Referrals Tracking: Track and analyze referrals with five reports: Referred Visitors, Referrers, Search Engines, Social Media, and Source Categories. The new Source Categories report includes support for Organic Search, Paid Search, Organic Social, Paid Social, and more. Lists your top referral sources such as search engines Author Analytics: Measures author performance. Geographic Reports: Location-based analytics, including countries, cities, European countries, US states, and regions within your country. Devices Report: Detailed device-specific analytics covering browsers, operating systems, device categories and device models. Bypass Ad Blockers: Dynamically load the tracking script with a unique name and address to bypass ad blockers. Integrate with WP Consent API: Ensures compatibility with consent plugins like Complianz and Cookiebot. Email reports with customizable content Customize role-based access to view analytics and modify settings. Advanced Filtering & Exceptions: By user roles, IPs, countries, URLs, and more. Premium Add-on: Data Plus Custom Post Type Tracking: DataPlus extends WP Statistics’ tracking to include all custom post types in addition to Posts and Pages. Custom Taxonomy Analytics: In addition to monitoring default taxonomies like Categories and Tags, DataPlus also tracks custom taxonomies. Link Tracker: Find out which outbound links your audience clicks on, giving you insights into their preferences and behaviors. Download Tracker: Keep track of what’s being downloaded, who’s downloading it, and when. Individual Author Performance: Detailed metrics on the performance of individual authors. Detailed Analytics for Each Country: In-depth analytics for each country to enhance geographical reporting. And more! Premium Add-on: Marketing Campaign Analytics: Track UTM-tagged links and see which campaigns drive the most visitors. Google Search Console Integration: Monitor impressions, clicks, and queries. Custom Event Tracking: Create goals based on clicks, pageviews, or events and monitor conversions. Built-in UTM Link Builder: Generate and validate campaign URLs inside your dashboard. Get the most out of your website analytics by using WP Statistics Premium Add-ons Upgrade your analytics toolkit with our range of premium add-ons, including Data Plus, Advanced Reporting, Real-Time Stats, Mini Chart, Marketing, and more. Making informed decisions is easier with these powerful tools. Special Offer: Save up to 60% on all premium features when you purchase WP Statistics Premium. Report Bugs Having trouble with a bug? Please create an issue on GitHub. Kindly note that GitHub is exclusively for bug reports; other inquiries will be closed. For security vulnerabilities, please report them through the Patchstack Vulnerability Disclosure Program. The Patchstack team will validate, triage, and handle any security issues.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C