Skip to content
Noroxi

WP Statistics

wp-statistics · plugin

Known security vulnerabilities for WP Statistics. Find out in seconds which version runs on your site with WP Lens.

23 known vulnerabilities

3 critical · 4 with public exploit code · latest Sep 30, 2026

Vulnerabilities

  • CVE-2022-25148

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

    Critical 9.8

  • CVE-2017-18515

    The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.

    Critical 9.8

  • CVE-2019-13275

    An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress.

    Critical 9.8

  • CVE-2022-38074

    WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection

    High 8.8

  • CVE-2022-25149

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

    High 7.5

  • CVE-2022-0651

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

    High 7.5

  • CVE-2022-0513

    WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason

    High 7.5

  • CVE-2026-15780

    WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

    High 7.2

  • CVE-2026-5231

    WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter

    High 7.2

  • CVE-2025-9816

    WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

    High 7.2

  • CVE-2024-2194

    WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

    High 7.2

  • CVE-2026-93770

    WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-48839

    WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-3488

    WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

    Medium 6.5

  • CVE-2021-4333

    WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation

    Medium 6.5

  • CVE-2026-84774

    WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2022-27231

    Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.

    Medium 6.1

  • CVE-2022-25307

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

    Medium 6.1

  • CVE-2022-25306

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

    Medium 6.1

  • CVE-2022-25305

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

    Medium 6.1

  • CVE-2025-3953

    WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings U

    Medium 5.4

  • CVE-2019-12566

    The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php.

    Medium 5.4

  • CVE-2025-55716

    WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability

    Medium 4.3

← Back to directory