CVE-2025-3953: medium-severity vulnerability in veronalabs WP Statistics – Simple…
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.3%
The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Related CVEs — veronalabs WP Statistics – Simple…
In the same product, most dangerous first.
CVE-2024-2194HIGHWP Statistics <= 14.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 63.2%CVE-2025-9816HIGHWP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderEPSS 12.1%CVE-2026-15780HIGHWP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterEPSS 0.6%CVE-2026-5231HIGHWP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' ParameterEPSS 0.5%CVE-2021-4333MEDIUMWP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and DeactivationEPSS 0.4%CVE-2026-3488MEDIUMWP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit ManipulationEPSS 0.3%