← All plugins

Plugin vulnerabilities

Is WP Statistics safe? Known vulnerabilities and the version to run.

WP Statistics: tracks visitors and page views inside WordPress, without Google Analytics.

Updated from Wordfence Intelligence

The short answer

Run WP Statistics 14.16.15 or later. That version has a fix for every known vulnerability that's been patched.

Known vulnerabilities
44
In the last 12 months
9
Rated high or critical
25
No fix yet
0

Every known WP Statistics vulnerability

Newest first. The most recent was disclosed on 2 October 2026. Each one links to its full record on Wordfence.

VulnerabilitySeverityAffected versionsFixed in
Reflected Cross-Site ScriptingCVE-2026-97276 · 2 October 2026Medium 6.114.16.14 and earlier14.16.15
Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter KeyCVE-2026-97652 · 1 October 2026Medium 6.114.16.14 and earlier14.16.15
Unauthenticated Stored Cross-Site ScriptingCVE-2026-93770 · 24 September 2026High 7.214.16.13 and earlier14.16.14
Unauthenticated Stored Cross-Site ScriptingCVE-2026-84774 · 2 September 2026High 7.214.16.11 and earlier14.16.12
Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterCVE-2026-15780 · 18 August 2026High 7.214.16.8 and earlier14.16.9
Authenticated (Subscriber+) Information ExposureCVE-2026-16562 · 3 August 2026Medium 4.314.16.9 and earlier14.16.10
Unauthenticated Stored Cross-Site ScriptingCVE-2026-48839 · 1 June 2026High 7.214.16.6 and earlier14.16.7
Unauthenticated Stored Cross-Site Scripting via 'utm_source' ParameterCVE-2026-5231 · 16 April 2026High 7.214.16.4 and earlier14.16.5
Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit ManipulationCVE-2026-3488 · 16 April 2026Medium 6.514.16.4 and earlier14.16.5
Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderCVE-2025-9816 · 26 September 2025High 7.214.15.4 and earlier14.15.5
Missing AuthorizationCVE-2025-55716 · 14 August 2025Medium 4.314.15 and earlier14.15.2
Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings UpdateCVE-2025-3953 · 29 April 2025Medium 5.414.13.3 and earlier14.13.4
Unauthenticated Stored Cross-Site ScriptingCVE-2024-2194 · 11 March 2024High 7.214.5 and earlier14.5.1
Authenticated (Admin+) SQL InjectionCVE-2023-0955 · 6 March 2023High 7.213.2.16 and earlier14.0
Authenticated (Subscriber+) SQL InjectionCVE-2022-38074 · 31 January 2023High 8.813.2.10 and earlier13.2.11
Authenticated (Admin+) SQL InjectionCVE-2022-4230 · 27 December 2022High 7.213.2.8 and earlier13.2.9
Authenticated (Subscriber+) SQL Injection8 September 2022High 8.813.2.5 and earlier13.2.6
Information Disclosure7 September 2022Medium 4.313.2.513.2.6
Cross-Site ScriptingCVE-2022-27231 · 24 May 2022Medium 6.1before 13.2.013.2.0
Reflected Cross-Site ScriptingCVE-2022-1005 · 11 May 2022Medium 6.1before 13.2.213.2.2
Unauthenticated Stored Cross-Site Scripting via platformCVE-2022-25307 · 17 February 2022High 7.213.1.5 and earlier13.1.6
Unauthenticated Blind SQL Injection via current_page_typeCVE-2022-0651 · 16 February 2022Critical 9.813.1.5 and earlier13.1.6
Unauthenticated SQL InjectionCVE-2022-25148 · 16 February 2022Critical 9.813.1.5 and earlier13.1.6
Unauthenticated Stored Cross-Site Scripting via IPCVE-2022-25305 · 16 February 2022High 7.213.1.5 and earlier13.1.6
Unauthenticated Blind SQL Injection via IPCVE-2022-25149 · 16 February 2022Critical 9.813.1.5 and earlier13.1.6

If you run WP Statistics

What to do now

  1. Check your version. In WordPress, go to Plugins and look under WP Statistics. Compare it with the affected versions above.
  2. Update to 14.16.15 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
  3. Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.

Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.

Marketing, analytics and email

MonsterInsights

Connects a site to Google Analytics and shows the reports inside WordPress.

12 known2 in the last year

Smash Balloon Instagram Feed

Shows an Instagram feed on a WordPress site.

7 known2 in the last year

Mailchimp for WordPress

A plugin that connects your site's sign-up forms to Mailchimp.

16 known6 in the last year

OptinMonster

Connects a site to OptinMonster's popups and sign-up forms.

5 known

FluentSMTP

Sends WordPress email through a proper mail service such as Amazon SES, Gmail or Mailgun.

6 known1 in the last year

Popup Maker

Builds popups, slide-ins and announcement bars.

22 known4 in the last year

Data sources and licences

Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Not sure yet?

Find out how exposed your site is.

Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.

Get a free security check Or protect it now
Security check
yourbusiness.com
Example
1 urgent2 to fix
  • Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
  • WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
  • 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix