smub ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)

• CVE-2026-5488 Medium 5.3 ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token' 0.3%
• CVE-2026-5464 High 7.2 ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process 0.7%
• CVE-2026-1992 High 8.8 ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation 0.7%
• CVE-2026-1993 High 8.8 ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update 0.4%