WP Statistics — Vulnerabilities & Security Advisories 9

WP Statistics is a WordPress plugin for tracking website traffic and analytics with over 1 million active installations. Historically, it has been susceptible to multiple remote code execution (RCE) vulnerabilities, cross-site scripting (XSS) flaws, and privilege escalation issues, accounting for its 9 recorded CVEs. The plugin's security posture has been compromised through insufficient input validation and improper access controls, leading to several high-severity incidents. In 2023, critical RCE vulnerabilities allowed attackers to execute arbitrary code with minimal user interaction, highlighting ongoing security challenges. Despite its popularity, the plugin's track record demonstrates recurring issues in sanitizing user inputs and implementing secure authentication mechanisms, making it a persistent target for exploitation.