Log in Start free

VeronaLabs

Products

ProductCVEsExploitedLatest
SlimStat Analytics14–Jun 17, 2026
WP SMS9–Jun 15, 2026
WP Statistics9–Oct 4, 2026
WP Statistics – Simple, privacy-friendly Google Analytics alternative8–Oct 2, 2026
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc2–Feb 8, 2024
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce2–Jan 3, 2024

Exploited and recent CVEs

  • CVE-2026-97276 High 7.1 WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-97652 Medium 6.1 WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key 0.3%
  • CVE-2026-93770 High 7.1 WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-84774 Medium 6.1 WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-15780 High 7.2 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter 0.6%
  • CVE-2026-54818 High 8.5 WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability 0.3%
  • CVE-2026-27410 Medium 6.5 WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability 0.3%
  • CVE-2026-40790 Medium 6.5 WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2026-48839 High 7.1 WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-7634 High 7.2 SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header 0.4%
  • CVE-2026-3488 Medium 6.5 WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation 0.3%
  • CVE-2026-5231 High 7.2 WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter 0.5%
  • CVE-2026-1238 High 7.2 SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh' 0.3%
  • CVE-2026-28136 High 7.6 WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability 0.3%
  • CVE-2025-69323 High 7.1 WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-25343 Medium 5.9 WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-13431 Medium 6.5 SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter 0.3%
  • CVE-2025-15055 High 7.2 SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters 0.3%
  • CVE-2025-15057 High 7.2 SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter 0.3%
  • CVE-2025-14151 High 7.2 SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting 0.4%
  • CVE-2025-62006 Medium 5.4 WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability 0.3%
  • CVE-2025-9816 High 7.2 WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header 12.1%
  • CVE-2025-55716 Medium 4.3 WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability 0.2%
  • CVE-2025-3953 Medium 5.4 WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update 0.3%
  • CVE-2023-33994 Medium 6.5 WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability 0.6%
  • CVE-2024-9548 High 7.2 Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting 0.5%
  • CVE-2024-43331 Medium 5.3 WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability 0.4%
  • CVE-2024-34811 Medium 5.9 WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-30454 Medium 4.3 WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-25920 Medium 6.5 WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability 0.3%