WP Statistics – Simple, privacy-friendly Google Analytics alternative vulnerabilities

Product

WP Statistics – Simple, privacy-friendly Google Analytics alternative

by veronalabs · last CVE Oct 2, 2026

CVEs

On KEV

7.2

Max CVSS

New 30D

Severity mix

Critical 0High 3Medium 3Low 0

Severity

Exploitation

Watch

Add WP Statistics – Simple, privacy-friendly Google Analytics alternative to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-15780	7.2	1%	Aug 19	WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter Affected: through 14.16.8
CVE-2026-5231	7.2	0%	Apr 17	WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter Affected: through 14.16.4
CVE-2025-9816	7.2	10%	Sep 27	WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header Affected: through 14.15.4
CVE-2026-3488	6.5	0%	Apr 17	WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation Affected: through 14.16.4
CVE-2026-97652	6.1	0%	Oct 2	WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key Affected: through 14.16.14
CVE-2025-3953	5.4	0%	Apr 30	WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update Affected: through 14.13.3