ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
google-analytics-dashboard-for-wp · plugin
Known security vulnerabilities for ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin). Find out in seconds which version runs on your site with WP Lens.
6 known vulnerabilities
latest Apr 24, 2026
Listed on wordpress.org · latest 10.3.0 · last updated Sep 16, 2026 · 300K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 8.8
CVE-2026-1993login required≤ 9.0.2
ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
- High 8.8
CVE-2026-1992login required≤ 9.0.2
ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
- High 7.2
CVE-2026-5464editor+≤ 9.1.2
ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
- Medium 5.4
CVE-2025-24750login required≤ 8.1.0
WordPress ExactMetrics plugin <= 8.1.0 - Broken Access Control vulnerability
- Medium 5.4
CVE-2023-23880contributor+≤ 7.14.1
WordPress ExactMetrics Plugin <= 7.14.1 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.3
CVE-2026-5488subscriber+≤ 9.1.2
ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).