VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 6 known issues Latest disclosed Apr 22, 2026

ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Vulnerabilities

Review known vulnerability records for the WordPress plugin ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) (`google-analytics-dashboard-for-wp`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-5464, CVE-2026-1993 and CVE-2026-1992, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
6
High or Critical
3
Patch Coverage
100%
Last Updated
Apr 22, 2026
Priority CVE Quick Links

Fast paths into ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
6
CVE-2026-1993 High 9.0.3
CVE-2026-1993 ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Privilege Escalation

ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update

CVE-2026-1992 High 9.0.3
CVE-2026-1992 ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Remote Code Execution

ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation

CVE-2026-5464 High 9.1.3
CVE-2026-5464 ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Remote Code Execution

ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process

CVE-2023-23880 Medium 7.14.2
CVE-2023-23880 ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Stored Cross-Site Scripting

ExactMetrics <= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2023-0082 Medium 7.12.1
CVE-2023-0082 ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Stored Cross-Site Scripting

ExactMetrics <= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting

CVE-2025-24750 Medium 8.2.0
CVE-2025-24750 ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Vulnerability

ExactMetrics <= 8.1.0 - Missing Authorization

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
6 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 3 high severity findings.
Recent CVEs
CVE-2026-5464, CVE-2026-1993 and CVE-2026-1992
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-5464
CVE-2026-5464: ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process

The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding...

Published
Apr 22, 2026
Patched Release
9.1.3
Affected Versions
Versions up to 9.1.2
Next Step
Update to 9.1.3 or newer if supported.
Open CVE-2026-5464 Report Open CVE Reference
Plugin High Patched: Yes CVE-2026-1993
CVE-2026-1993: ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. Thi...

Published
Mar 10, 2026
Patched Release
9.0.3
Affected Versions
7.1.0 through 9.0.2
Next Step
Update to 9.0.3 or newer if supported.
Open CVE-2026-1993 Report Open CVE Reference
Plugin High Patched: Yes CVE-2026-1992
CVE-2026-1992: ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` param...

Published
Mar 10, 2026
Patched Release
9.0.3
Affected Versions
8.0.0 through 9.0.2
Next Step
Update to 9.0.3 or newer if supported.
Open CVE-2026-1992 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-24750
CVE-2025-24750: ExactMetrics <= 8.1.0 - Missing Authorization

The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 8.1.0. This makes it possible for authenticated attac...

Published
Jan 24, 2025
Patched Release
8.2.0
Affected Versions
Versions up to 8.1.0
Next Step
Update to 8.2.0 or newer if supported.
Open CVE-2025-24750 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-23880
CVE-2023-23880: ExactMetrics <= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The ExactMetrics plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Published
May 09, 2023
Patched Release
7.14.2
Affected Versions
Versions up to 7.14.1
Next Step
Update to 7.14.2 or newer if supported.
Open CVE-2023-23880 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-0082
CVE-2023-0082: ExactMetrics <= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting

The ExactMetrics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unspecified block options in posts/pages within versions up to, and including, 7.12.0 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level at...

Published
Jan 13, 2023
Patched Release
7.12.1
Affected Versions
Versions up to 7.12.0
Next Step
Update to 7.12.1 or newer if supported.
Open CVE-2023-0082 Report Open CVE Reference