Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

WP Statistics – Simple, privacy-friendly Google Analytics alternative Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 38 vulnerability records associated with WP Statistics – Simple, privacy-friendly Google Analytics alternative, published between 2012 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

38Total records
5Critical
17High
16Medium
0Low
0Informational
38Patched records
0Currently marked unpatched
2012-05-15First disclosure
2026-06-01Latest disclosure
27 of 38CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201211 records
201422 records
201533 records
201744 records
201944 records
202133 records
20221212 records
202322 records
202411 records
202533 records
202633 records

Severity Breakdown

SeverityRecordsShare
Critical513.2%
High1744.7%
Medium1642.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

21 records55.3%

First: 2012. Latest: 2026.

SQL Injection

12 records31.6%

First: 2015. Latest: 2023.

Missing Authorization

3 records7.9%

First: 2025. Latest: 2026.

CSRF

1 record2.6%

First: 2021. Latest: 2021.

Information Disclosure

1 record2.6%

First: 2022. Latest: 2022.

Patch Status

Patched
38
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 14.16.7
  • 14.16.5
  • 14.15.5
  • 14.15.2
  • 14.13.4
  • 14.5.1
  • 14.0
  • 13.2.11
  • 13.2.9
  • 13.2.6
  • 13.2.0
  • 13.2.2
  • 13.1.6
  • 13.1.5
  • 13.1.2
  • 13.1
  • 13.0.8
  • 12.6.7
  • 12.6.6.1
  • 12.6.4
  • 12.0.10
  • 12.0.9
  • 12.0.8
  • 12.0.5
  • 9.5.2
  • 9.4.1
  • 9.1.3
  • 8.5
  • 8.3.1
  • 2.2.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-12.6.6.1WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP ManipulationJuly 1, 201912.6.7High
*-12.6.5WP Statistics <= 12.6.5 - Stored Cross-Site ScriptingMay 31, 201912.6.6.1Medium
*-12.6.3WP Statistics <= 12.6.3 - Referer Cross-Site ScriptingApril 9, 201912.6.4Medium
*-12.0.9WP Statistics <= 12.0.9 - Authenticated Cross-Site ScriptingJuly 7, 201712.0.10Medium
*-12.0.8.1WP Statistics <= 12.0.8.1 - Reflected Cross-Site ScriptingJuly 3, 201712.0.9Medium
*-12.0.7WP Statistics <= 12.0.7 - Authenticated SQL InjectionJune 30, 201712.0.8High
*-12.0.4WP Statistics <= 12.0.4 - Stored Cross-Site ScriptingApril 13, 201712.0.5Medium
*-9.5.1WP Statistics <= 9.5.1 - Cross-Site ScriptingAugust 10, 20159.5.2Medium
[*, 9.4.1)WP Statistics < 9.4.1 - Authenticated Blind SQL InjectionJuly 9, 20159.4.1High
[*, 9.1.3)WP Statistics < 9.1.3 - Authenticated (Admin+) Stored Cross-Site ScriptingApril 15, 20159.1.3Medium
*-8.4WP Statistics <= 8.4 - Stored Cross-Site ScriptingDecember 3, 20148.5High
[*, 8.3.1)WP Statistics < 8.3.1 - Multiple Cross-Site ScriptingNovember 20, 20148.3.1High
*-2.2.4WP Statistics <= 2.2.4 - Cross-Site ScriptingMay 15, 20122.2.5Medium

Selected source records

Latest Records

HighCVE-2026-48839

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting

Published: June 1, 2026

Affected versions
*-14.16.6
Patched versions
14.16.7
Original Wordfence record
MediumCVE-2026-3488

WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

Published: April 16, 2026

Affected versions
*-14.16.4
Patched versions
14.16.5
Original Wordfence record
HighCVE-2026-5231

WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter

Published: April 16, 2026

Affected versions
*-14.16.4
Patched versions
14.16.5
Original Wordfence record
HighCVE-2025-9816

WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

Published: September 26, 2025

Affected versions
*-14.15.4
Patched versions
14.15.5
Original Wordfence record
MediumCVE-2025-55716

WP Statistics <= 14.15 - Missing Authorization

Published: August 14, 2025

Affected versions
*-14.15
Patched versions
14.15.2
Original Wordfence record
MediumCVE-2025-3953

WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update

Published: April 29, 2025

Affected versions
*-14.13.3
Patched versions
14.13.4
Original Wordfence record
HighCVE-2024-2194

WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

Published: March 11, 2024

Affected versions
*-14.5
Patched versions
14.5.1
Original Wordfence record
HighCVE-2023-0955

WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection

Published: March 6, 2023

Affected versions
*-13.2.16
Patched versions
14.0
Original Wordfence record

Highest-Severity Records

CriticalCVE-2022-0651

WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type

Published: February 16, 2022

Affected versions
*-13.1.5
Patched versions
13.1.6
Original Wordfence record
CriticalCVE-2022-25148

WP Statistics <= 13.1.5 - Unauthenticated SQL Injection

Published: February 16, 2022

Affected versions
*-13.1.5
Patched versions
13.1.6
Original Wordfence record
CriticalCVE-2022-25149

WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP

Published: February 16, 2022

Affected versions
*-13.1.5
Patched versions
13.1.6
Original Wordfence record
CriticalCVE-2019-13275

WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

Published: July 1, 2019

Affected versions
*-12.6.6.1
Patched versions
12.6.7
Original Wordfence record
CriticalCVE-2022-0513

WP Statistics <= 13.1.4 - Unauthenticated Blind SQL Injection

Published: February 10, 2022

Affected versions
*-13.1.4
Patched versions
13.1.5
Original Wordfence record
HighCVE-2017-18515

WP Statistics <= 12.0.7 - Authenticated SQL Injection

Published: June 30, 2017

Affected versions
*-12.0.7
Patched versions
12.0.8
Original Wordfence record
High

WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection

Published: September 8, 2022

Affected versions
*-13.2.5
Patched versions
13.2.6
Original Wordfence record
HighCVE-2022-38074

WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection

Published: January 31, 2023

Affected versions
*-13.2.10
Patched versions
13.2.11
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory