WP Statistics – Simple, privacy-friendly Google Analytics alternative — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in WP Statistics – Simple, privacy-friendly Google Analytics alternative, with AI-generated Chinese analysis, references, and POCs.

Vendor: veronalabs

CVE ID	Title	CVSS	Severity	Published
CVE-2026-15780	WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter CWE-79	7.2	High	2026-08-19
CVE-2026-3488	WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation CWE-862	6.5	Medium	2026-04-17
CVE-2026-5231	WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter CWE-79	7.2	High	2026-04-17
CVE-2025-9816	WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header CWE-79	7.2	High	2025-09-27
CVE-2025-3953	WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update CWE-862	5.4	Medium	2025-04-30
CVE-2024-2194	WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting CWE-79	7.2	High	2024-03-13
CVE-2021-4333	WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation CWE-352	6.5	Medium	2023-03-07

All 7 known CVE vulnerabilities affecting WP Statistics – Simple, privacy-friendly Google Analytics alternative with full Chinese analysis, references, and POCs where available.