What’s Vulnerable › Products
WP Statistics vulnerabilities
32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your WP Statistics version is affected
Latest WP Statistics vulnerabilities
- CVE-2026-97276 — WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-97652 — WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key (CVSS 6.1)
- CVE-2026-93770 — WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-84774 — WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2026-15780 — WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter (CVSS 7.2)
- CVE-2026-16562 — WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers (CVSS 6.5)
- CVE-2026-48839 — WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-5231 — WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter (CVSS 7.2)
- CVE-2026-3488 — WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation (CVSS 6.5)
- CVE-2025-9816 — WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (CVSS 7.2)
- CVE-2025-55716 — WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability (CVSS 4.3)
- CVE-2025-3953 — WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update (CVSS 5.4)
- CVE-2024-2194 — WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- CVE-2023-0955 — WP Statistics < 14.0 - Authenticated SQLi (CVSS 8.8)
- CVE-2022-38074 — WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection (CVSS 8.8)
- CVE-2021-4333 — WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation (CVSS 6.5)
- CVE-2022-4230 — WP Statistics < 13.2.9 - Authenticated SQLi (CVSS 8.8)
- CVE-2022-27231 — (CVSS 6.1)
- CVE-2022-1005 — WP Statistics < 13.2.2 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2022-25307 — WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform (CVSS 6.1)
- CVE-2022-25306 — WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser (CVSS 6.1)
- CVE-2022-25305 — WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP (CVSS 6.1)
- CVE-2022-25149 — WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP (CVSS 7.5)
- CVE-2022-25148 — WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id (CVSS 5.0)
- CVE-2022-0651 — WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type (CVSS 7.5)