WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in WP Statistics – Simple, privacy-friendly Google Analytics alternative

Get website traffic insights with GDPR/CCPA compliant, privacy-friendly analytics. Includes visitor data, stunning graphs, and no data sharing.

41Reported vulnerabilities
9.8Highest CVSS score
14.16.10Latest version
600,000+Active installs

What to do now

Update WP Statistics – Simple, privacy-friendly Google Analytics alternative to 14.16.9 or later. 41 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 25, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-25148 Critical 9.8 80.9% 13.1.5 and earlier 13.1.6 February 24, 2022
CVE-2022-25149 High 7.5 77.5% 13.1.5 and earlier 13.1.6 February 24, 2022
CVE-2022-25305 Medium 6.1 78.9% 13.1.5 and earlier 13.1.6 February 24, 2022
CVE-2024-2194 High 7.2 67.7% 14.5 and earlier 14.5.1 March 11, 2024
CVE-2022-0513 High 7.5 53.5% 13.1.4 and earlier 13.1.5 February 16, 2022
CVE-2022-4230 High 8.8 35.7% Before 13.2.9 13.2.9 January 23, 2023
CVE-2022-0651 High 7.5 32.2% 13.1.5 and earlier 13.1.6 February 24, 2022
CVE-2021-24340 High 7.5 29.8% Before 13.0.8 13.0.8 June 7, 2021
CVE-2019-13275 Critical 9.8 2.6% 12.6.6 and earlier 12.6.7 July 4, 2019
CVE-2023-0955 High 8.8 0.9% Before 14.0 14.0 March 27, 2023
CVE-2025-9816 High 7.2 9.7% 0 to 14.15.4 (inclusive) 14.15.5 September 27, 2025
CVE-2017-18515 Critical 9.8 2.5% Before 12.0.8 12.0.8 August 14, 2019
CVE-2022-25307 Medium 6.1 1.4% 13.1.5 and earlier 13.1.6 February 24, 2022
CVE-2022-25306 Medium 6.1 1.4% 13.1.5 and earlier 13.1.6 February 24, 2022
CVE-2022-1005 Medium 6.1 0.9% Before 13.2.2 13.2.2 June 8, 2022
CVE-2018-1000556 Medium 6.1 0.7% Before 12.0.6 12.0.6 June 26, 2018
CVE-2019-12566 Medium 5.4 1.1% 12.6.5 and earlier 12.6.6.1 June 3, 2019
CVE-2022-38074 High 8.8 0.7% 13.2.10 and earlier 13.2.11 January 31, 2023
WF-42f54887-ce98-4360-8d07-37b1a48fc3fd High 8.8 — 13.2.5 and earlier 13.2.6 September 8, 2022
WF-364804a5-8699-46be-b25e-890a10134a25 High 8.7 — Before 9.4.1 9.4.1 July 9, 2015
CVE-2026-15780 High 7.2 0.4% 0 to 14.16.8 (inclusive) 14.16.9 August 19, 2026
CVE-2026-5231 High 7.2 0.5% 0 to 14.16.4 (inclusive) 14.16.5 April 17, 2026
CVE-2026-48839 High 7.2 0.2% 14.16.6 and earlier 14.16.7 June 1, 2026
WF-69f861bf-933f-4413-a5c0-fd39ee78e594 High 7.2 — 12.6.6.1 and earlier 12.6.7 July 1, 2019
CVE-2017-2136 Medium 6.1 2.6% 12.0.4 and earlier 12.0.5 April 13, 2017
WF-0b8af407-b49d-4d3f-a7a5-c3ad3d56fcba High 7.2 — 8.4 and earlier 8.5 December 3, 2014
WF-1d14779f-3ee5-4a55-b49d-e9162db2f4a2 High 7.2 — Before 8.3.1 8.3.1 November 20, 2014
CVE-2026-3488 Medium 6.5 0.3% 0 to 14.16.4 (inclusive) 14.16.5 April 17, 2026
CVE-2021-4333 Medium 6.5 0.4% 13.1.1 and earlier 13.1.2 March 7, 2023
CVE-2022-27231 Medium 6.1 1.0% Before 13.2.0 13.2.0 May 24, 2022
CVE-2019-10864 Medium 6.1 1.4% 12.6.2 and earlier 12.6.4 April 23, 2019
CVE-2017-10991 Medium 6.1 0.8% 12.0.9 and earlier 12.0.10 July 7, 2017
WF-ba88a1f5-9ebf-4899-81b3-e65587ae2fe2 Medium 6.1 — 13.0.9 and earlier 13.1 August 30, 2021
WF-63f588c6-6bad-44d2-a9d9-832d3a7d33ea Medium 6.1 — 12.0.8.1 and earlier 12.0.9 July 3, 2017
WF-70db1a8e-ebff-4505-9e43-1ce48e94f3c5 Medium 6.1 — 9.5.1 and earlier 9.5.2 August 10, 2015
WF-f3a4aeb2-3929-4f6b-ac6e-bccc1c3bf0dd Medium 6.1 — 2.2.4 and earlier 2.2.5 May 15, 2012
CVE-2025-3953 Medium 5.4 0.3% 0 to 14.13.3 (inclusive) 14.13.4 April 30, 2025
WF-f7cb3540-ffdb-4b4c-a518-4ca8232ab53f Medium 5.5 — Before 9.1.3 9.1.3 April 15, 2015
CVE-2026-16562 Medium 4.3 0.2% 14.16.9 and earlier 14.16.10 August 3, 2026
CVE-2025-55716 Medium 4.3 0.2% 14.15 and earlier 14.15.2 August 14, 2025
WF-7a0c6425-866d-4b50-b464-87a8173c4abd Medium 4.3 — 13.2.5 to 13.2.5 (inclusive) 13.2.6 September 7, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.