Known vulnerabilities in MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)

The best free Google Analytics plugin for WordPress. See how visitors find and use your website so you can grow your business with powerful analytics.

10Reported vulnerabilities

7.2Highest CVSS score

11.1.2Latest version

2,000,000+Active installs

What to do now

Update MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) to 11.1.0 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 29, 2026 / Tested up to WordPress: 7.0.0 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-5371	High 7.1	0.3%	0 to 10.1.2 (inclusive)	`10.1.3`	May 12, 2026
WF-9c40773d-3a2f-46b6-861e-608d662250da	High 7.2	—	5.3.3 and earlier	`5.4`	April 20, 2015
WF-a53a1178-7267-4d7f-ad9e-2906c05b8fe0	High 7.2	—	5.3.2 and earlier	`5.3.3`	March 19, 2015
CVE-2023-23999	Medium 6.4	0.4%	8.14.0 and earlier	`8.14.1`	May 10, 2023
WF-247f6b86-767b-479f-90d4-79345699dd59	Medium 6.4	—	7.1 and earlier	`7.2.0`	September 18, 2018
WF-7e9dcedd-aa81-47c4-9fc5-cecc7bc394b5	Medium 5.5	—	5.3.2 and earlier	`5.3.3`	March 6, 2015
CVE-2026-11366	Medium 5.3	0.2%	11.0.0 and earlier	`11.1.0`	July 27, 2026
CVE-2014-9174	Medium 4.3	2.0%	5.1.2 and earlier 5.1 to 5.1 (inclusive) 5.1.1 to 5.1.1 (inclusive)	`5.1.3`	December 2, 2014
CVE-2023-52220	Medium 4.3	0.4%	8.21.0 and earlier	`8.22.0`	January 5, 2024
WF-6b6fa5c6-e9a9-45c6-a02b-3630d8ef130e	Low 3.8	—	5.4.4 and earlier	`5.4.5`	August 10, 2015

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.