# WP Statistics – Simple, privacy-friendly Google Analytics alternative

> Cookieless, privacy-friendly WordPress analytics. GDPR/CCPA compliant visitor data and clear graphs, with no data sharing.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:31 UTC.

## Facts (WordPress.org)

- Slug: `wp-statistics`
- Author: VeronaLabs
- Version: 14.16.18
- Active installs: 500,000+
- Last update: 2026-10-23 (21 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.6, PHP 7.4
- Tags: analytics, cookieless, GDPR, google analytics, stats
- Page: https://wordpress.org/plugins/wp-statistics/

## Checks (against WordPress 7.1.4)

- OK: Updated 21 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Phones home ↔ Private, Heavy ↔ Light, Behind ↔ Current, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit.

## Known vulnerabilities

- 2026-10-04 MEDIUM: Reflected Cross-Site Scripting (up to 14.16.14). CVE-2026-97276, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d8e8c4-f4b7-40ce-baf1-2162e7ccf05e?source=api-prod
- 2026-10-02 MEDIUM: Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key (up to 14.16.14). CVE-2026-97652, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1d2fe2-816b-46ee-8ab5-ae9936ac9ded?source=api-prod
- 2026-09-30 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 14.16.13). CVE-2026-93770, https://www.wordfence.com/threat-intel/vulnerabilities/id/6546d73e-3b2e-4e90-bf93-81e8459d800d?source=api-prod
- 2026-09-03 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 14.16.11). CVE-2026-84774, https://www.wordfence.com/threat-intel/vulnerabilities/id/46ee11ee-79ef-4a64-8e04-43915fb4774e?source=api-prod
- 2026-08-19 HIGH: Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter (up to 14.16.8). CVE-2026-15780, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5baecfe-ce0b-4cec-8462-bfd7eadd41e9?source=api-prod
- 2026-08-08 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 14.16.9). CVE-2026-16562, https://www.wordfence.com/threat-intel/vulnerabilities/id/762be203-b4bb-4618-9916-1ed4f33dbe2e?source=api-prod
- 2026-06-01 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 14.16.6). CVE-2026-48839, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd389d3b-046c-41cb-a077-7dcb9fd50eda?source=api-prod
- 2026-04-17 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation (up to 14.16.4). CVE-2026-3488, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1938ba4-ced7-455b-8772-a192d9cb0897?source=api-prod
- 2026-04-17 HIGH: Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter (up to 14.16.4). CVE-2026-5231, https://www.wordfence.com/threat-intel/vulnerabilities/id/9b350b48-05ba-4054-895f-36d7ad71459d?source=api-prod
- 2025-09-26 HIGH: Unauthenticated Stored Cross-Site Scripting via User-Agent Header (up to 14.15.4). CVE-2025-9816, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8351204-da6d-443a-98b5-0608bfb1e9d0?source=api-prod
- 2025-08-14 MEDIUM: Missing Authorization (up to 14.15). CVE-2025-55716, https://www.wordfence.com/threat-intel/vulnerabilities/id/263029e3-68ef-416b-97f4-187647b9502d?source=api-prod
- 2025-04-29 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update (up to 14.13.3). CVE-2025-3953, https://www.wordfence.com/threat-intel/vulnerabilities/id/07f7ef07-0f14-4b74-8d47-d5dece4954b0?source=api-prod
- 2024-03-11 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 14.5). CVE-2024-2194, https://www.wordfence.com/threat-intel/vulnerabilities/id/e44e4bdd-d84e-4315-9232-48a3b240242d?source=api-prod
- 2023-03-06 HIGH: Authenticated (Admin+) SQL Injection (up to 13.2.16). CVE-2023-0955, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ffd60d2-ae8d-4738-a4f4-6df6e0ffa8c6?source=api-prod
- 2023-01-31 HIGH: Authenticated (Subscriber+) SQL Injection (up to 13.2.10). CVE-2022-38074, https://www.wordfence.com/threat-intel/vulnerabilities/id/7638fd24-d376-4b5b-98bb-4a40ada6a4da?source=api-prod
- 2022-12-27 HIGH: Authenticated (Admin+) SQL Injection (up to 13.2.8). CVE-2022-4230, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e4d8c3-f3ab-40f9-a8d2-77b53a8dba72?source=api-prod
- 2022-09-08 HIGH: Authenticated (Subscriber+) SQL Injection (up to 13.2.5). WF-42f54887-ce98-4360-8d07-37b1a48fc3fd, https://www.wordfence.com/threat-intel/vulnerabilities/id/42f54887-ce98-4360-8d07-37b1a48fc3fd?source=api-prod
- 2022-09-07 MEDIUM: Information Disclosure (13.2.5 to 13.2.5). WF-7a0c6425-866d-4b50-b464-87a8173c4abd, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0c6425-866d-4b50-b464-87a8173c4abd?source=api-prod
- 2022-05-24 MEDIUM: Cross-Site Scripting (before 13.2.0). CVE-2022-27231, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7e922a-fae0-46f9-b8c1-0986b88f2813?source=api-prod
- 2022-05-11 MEDIUM: Reflected Cross-Site Scripting (before 13.2.2). CVE-2022-1005, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6f549c8-673b-4032-9b56-5a2e2239eff3?source=api-prod
- 2022-02-17 HIGH: Unauthenticated Stored Cross-Site Scripting via platform (up to 13.1.5). CVE-2022-25307, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2165d61-dc86-4893-91c4-85f0a577fc1c?source=api-prod
- 2022-02-16 CRITICAL: Unauthenticated Blind SQL Injection via current_page_type (up to 13.1.5). CVE-2022-0651, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f0051d5-b236-420c-ae65-14610d05c6d1?source=api-prod
- 2022-02-16 CRITICAL: Unauthenticated SQL Injection (up to 13.1.5). CVE-2022-25148, https://www.wordfence.com/threat-intel/vulnerabilities/id/46545227-3c04-40a4-a25c-8f43845e90d3?source=api-prod
- 2022-02-16 HIGH: Unauthenticated Stored Cross-Site Scripting via IP (up to 13.1.5). CVE-2022-25305, https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3bcd70-d19c-4c0f-80d0-a69e2ab947d2?source=api-prod
- 2022-02-16 CRITICAL: Unauthenticated Blind SQL Injection via IP (up to 13.1.5). CVE-2022-25149, https://www.wordfence.com/threat-intel/vulnerabilities/id/9555c48f-5ce3-4c0c-88f3-83776b42b808?source=api-prod
- 2022-02-16 HIGH: Unauthenticated Stored Cross-Site Scripting via browser (up to 13.1.5). CVE-2022-25306, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcb68038-96a6-40b6-a37c-757fc19cbe0c?source=api-prod
- 2022-02-10 CRITICAL: Unauthenticated Blind SQL Injection (up to 13.1.4). CVE-2022-0513, https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc2a1f7-4c3c-4f37-a187-572f40e9b792?source=api-prod
- 2021-09-11 MEDIUM: Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation (up to 13.1.1). CVE-2021-4333, https://www.wordfence.com/threat-intel/vulnerabilities/id/215937d9-739b-4198-b375-6d171bbac64a?source=api-prod
- 2021-08-30 MEDIUM: Reflected Cross-Site Scripting (up to 13.0.9). WF-ba88a1f5-9ebf-4899-81b3-e65587ae2fe2, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba88a1f5-9ebf-4899-81b3-e65587ae2fe2?source=api-prod
- 2021-05-19 HIGH: Unauthenticated SQL Injection (before 13.0.8). CVE-2021-24340, https://www.wordfence.com/threat-intel/vulnerabilities/id/6f561cce-1c0c-40f5-abba-ada8bc503aa8?source=api-prod
- 2019-07-01 HIGH: Unauthenticated Stored Cross-Site Scripting via IP Manipulation (up to 12.6.6.1). WF-69f861bf-933f-4413-a5c0-fd39ee78e594, https://www.wordfence.com/threat-intel/vulnerabilities/id/69f861bf-933f-4413-a5c0-fd39ee78e594?source=api-prod
- 2019-07-01 CRITICAL: Unauthenticated Blind SQL Injection (up to 12.6.6.1). CVE-2019-13275, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9fd9e1-c4b8-420e-a4d3-30c934853a98?source=api-prod
- 2019-05-31 MEDIUM: Stored Cross-Site Scripting (up to 12.6.5). CVE-2019-12566, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc684cd2-f01a-4c2d-b979-a47b83d01bd2?source=api-prod
- 2019-04-09 MEDIUM: Referer Cross-Site Scripting (up to 12.6.3). CVE-2019-10864, https://www.wordfence.com/threat-intel/vulnerabilities/id/cdbad4b2-961a-41df-b284-14deb0a76677?source=api-prod
- 2017-07-07 MEDIUM: Authenticated Cross-Site Scripting (up to 12.0.9). CVE-2017-10991, https://www.wordfence.com/threat-intel/vulnerabilities/id/eb519441-2598-4907-8e49-036c455176ad?source=api-prod
- 2017-07-03 MEDIUM: Reflected Cross-Site Scripting (up to 12.0.8.1). WF-63f588c6-6bad-44d2-a9d9-832d3a7d33ea, https://www.wordfence.com/threat-intel/vulnerabilities/id/63f588c6-6bad-44d2-a9d9-832d3a7d33ea?source=api-prod
- 2017-06-30 HIGH: Authenticated SQL Injection (up to 12.0.7). CVE-2017-18515, https://www.wordfence.com/threat-intel/vulnerabilities/id/3be36cd6-27a3-4b15-9e43-b1f6c25efae6?source=api-prod
- 2017-04-13 MEDIUM: Stored Cross-Site Scripting (up to 12.0.4). CVE-2017-2136, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd981fb-ef75-4ed3-a18f-4ad9eaa148f4?source=api-prod
- 2015-08-10 MEDIUM: Cross-Site Scripting (up to 9.5.1). WF-70db1a8e-ebff-4505-9e43-1ce48e94f3c5, https://www.wordfence.com/threat-intel/vulnerabilities/id/70db1a8e-ebff-4505-9e43-1ce48e94f3c5?source=api-prod
- 2015-07-09 HIGH: Authenticated Blind SQL Injection (before 9.4.1). WF-364804a5-8699-46be-b25e-890a10134a25, https://www.wordfence.com/threat-intel/vulnerabilities/id/364804a5-8699-46be-b25e-890a10134a25?source=api-prod
- 2015-04-15 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (before 9.1.3). WF-f7cb3540-ffdb-4b4c-a518-4ca8232ab53f, https://www.wordfence.com/threat-intel/vulnerabilities/id/f7cb3540-ffdb-4b4c-a518-4ca8232ab53f?source=api-prod
- 2014-12-03 HIGH: Stored Cross-Site Scripting (up to 8.4). WF-0b8af407-b49d-4d3f-a7a5-c3ad3d56fcba, https://www.wordfence.com/threat-intel/vulnerabilities/id/0b8af407-b49d-4d3f-a7a5-c3ad3d56fcba?source=api-prod
- 2014-11-20 HIGH: Multiple Cross-Site Scripting (before 8.3.1). WF-1d14779f-3ee5-4a55-b49d-e9162db2f4a2, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d14779f-3ee5-4a55-b49d-e9162db2f4a2?source=api-prod
- 2012-05-15 MEDIUM: Cross-Site Scripting (up to 2.2.4). WF-f3a4aeb2-3929-4f6b-ac6e-bccc1c3bf0dd, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a4aeb2-3929-4f6b-ac6e-bccc1c3bf0dd?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-statistics · HTML: https://todaywp.com/plugins/wp-statistics