Skip to content
PluginCanary

SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce

by VeronaLabs · 70,000+ active installs · Checked 3 Nov 2026
Watch

Watch: 10 vulnerabilities published in the last 24 months.

75/ 100 Canary Score
Sub-scores for SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce
Ownership100
Maintenance100
Security60
Support29
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • InfoSEC-310 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
coolmann12 Apr 2010 to 8 Nov 2022, 1135 commits
mostafa.s199016 Nov 2022 to 26 Oct 2026, 62 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
8 days ago
Releases, 24 months
24
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce
Q1 20243
Q2 20243
Q3 20244
Q4 20243
Q1 20251
Q2 20253
Q3 20252
Q4 20254
Q1 20268
Q2 20264
Q3 20260
Q4 20261

Last release 26 Oct 2026. Tested with WordPress 7.1 (current).

Support

29% of 7 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
29 Jun 2026SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.4.05.5.00
17 Jun 2026SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection6.5<= 5.4.115.4.120
1 Jun 2026SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection8.1< 5.4.05.4.00
27 May 2026SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header7.2<= 5.4.115.4.120
18 Mar 2026SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'7.2<= 5.3.55.4.00
10 Feb 2026SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter6.5<= 5.3.15.3.20
27 Jan 2026Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting6.1<= 5.3.25.3.30
8 Jan 2026SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter7.2<= 5.3.35.3.40
8 Jan 2026SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters7.2<= 5.3.45.3.50
18 Dec 2025SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.3.25.3.30
14 Oct 2024Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.2.65.2.70
1 Feb 2024SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 5.1.35.1.40
11 Sep 2023Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode8.8<= 5.0.95.0.100
28 Aug 2023Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 5.0.95.0.101
22 Aug 2023Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview4.3<= 5.0.5.15.0.60
22 Aug 2023Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings4.4<= 5.0.85.0.93
11 May 2023Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection7.2<= 5.0.45.0.52
11 May 2023Slimstat Analytics <= 5.0.4 - Reflected Cross-Site Scripting6.1<= 5.0.45.0.52
30 Mar 2023Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8<= 4.9.3.34.9.3.4n/a
23 Feb 2023Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8<= 4.9.3.24.9.3.30
19 Dec 2022Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.9.24.9.30
12 Dec 2022Slimstat Analytics <= 4.9.2 - Reflected Cross-Site Scripting via REQUEST_URI6.1<= 4.9.24.9.30
22 May 2019Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting8.8< 4.8.44.8.448
21 May 2019WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors6.1<= 4.84.8.10
22 Jul 2015Slimstat Analytics < 4.1.6.1 - Cross-Site Scripting6.1< 4.1.6.14.1.6.16

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce
Q1 20245.0
Q2 20245.0
Q2 20251.0
Q3 20255.0
Q1 20263.7
Q3 20263.0

Average rating fell from 5.0 to 3.0 between Q1 2024 and Q3 2026.

Rating distribution
5 star742
4 star30
3 star7
2 star8
1 star29
Latest low reviews

Momentum

70,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce
4 May 20261,467
11 May 202625,918
18 May 20265,282
25 May 20263,706
1 Jun 20262,513
8 Jun 20262,186
15 Jun 20261,913
22 Jun 202624,440
29 Jun 20264,673
6 Jul 20263,957
13 Jul 20262,621
20 Jul 20262,667
27 Jul 20262,829
3 Aug 20262,024
10 Aug 20261,688
17 Aug 20261,675
24 Aug 20261,644
31 Aug 20261,745
7 Sep 20261,441
14 Sep 20261,507
21 Sep 20261,454
28 Sep 20261,364
5 Oct 20261,422
12 Oct 20261,318
19 Oct 20263,913
26 Oct 202629,015
2 Nov 2026942

Weekly downloads over the last 4 weeks are 76% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Post Views CounterScore 93 · 100,000+Page Visits Counter - LiteScore 93 · 5,000+GA Google Analytics - Connect Google Analytics to WordPressScore 92 · 400,000+Matomo Analytics - Powerful, Privacy-First Insights for WordPressScore 92 · 100,000+Microsoft ClarityScore 91 · 200,000+

Facts

Version6.0.0
AuthorVeronaLabs
Added12 Apr 2010
Last updated26 Oct 2026
Active installs70,000+
Requires WordPress5.6
Tested up to7.1.4
Requires PHP7.4
CategoryAnalytics & Reporting > Traffic & Visitor Analytics
Tagsheatmap, tracking, analytics, statistics, woocommerce analytics

Other plugins by this author: WP Statistics - Simple, privacy-friendly Google Analytics alternative, WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS, FeedbackBird - Easily Collect Ideas, Issues, and Feedback on WordPress, SpamLens: Jev AI Spam Protection for Comments and Contact Form 7, MonoRanks - AI SEO Audit, AEO and GEO with One-Click Fixes, WConvert - Popup Builder, Email Optin Forms & Lead Capture

Questions

Is SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce still maintained?

SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce was last updated on 26 Oct 2026. Its Canary status is Watch.

Is SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce safe?

SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce has no open unpatched vulnerabilities on record. 10 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce?

The wordpress.org author is VeronaLabs. Recent committers: mostafa.s1990, coolmann, plugin-master. We have recorded no ownership change.

What can I use instead of SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce?

Plugins in the same category with a higher Canary Score: Post Views Counter, Page Visits Counter - Lite, GA Google Analytics - Connect Google Analytics to WordPress, Matomo Analytics - Powerful, Privacy-First Insights for WordPress, Microsoft Clarity.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue