Skip to content
PluginCanary

WP Statistics

WP Statistics - Simple, privacy-friendly Google Analytics alternative
by VeronaLabs · 500,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 23 Oct 2026, 45 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for WP Statistics
Ownership100
Maintenance100
Security60
Support90
Reputation85

How the score works

Quick answers

Is WP Statistics still maintained?
Yes. Last release 23 Oct 2026, 45 releases in the last 24 months. 23 Oct 2026 · wordpress.org
Who owns WP Statistics, and has it changed hands?
No change recorded. Main committer mostafa.s1990 since Mar 2011. 4 Nov 2026 · SVN log
Was WP Statistics removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is WP Statistics safe?
44 known vulnerabilities, all fixed (latest in 14.16.15). Not on the exploited list. 2 Oct 2026 · Wordfence Intelligence
Is the latest WP Statistics update safe to install?
No ownership change before 14.16.18. No one-star spike after it. 23 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
mostafa.s199020 Mar 2011 to 23 Oct 2026, 370 commits

1 committer recorded. No ownership change since 2011.

Maintenance

Last release
12 days ago
Releases, 24 months
45
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP Statistics
Q1 202410
Q2 202410
Q3 20247
Q4 20247
Q1 20257
Q2 20257
Q3 20256
Q4 20252
Q1 20264
Q2 20264
Q3 20266
Q4 20264

Last release 23 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (3 reviews). Lifetime: 4.1.

Average rating per quarter for WP Statistics
Q4 20254.5
Q1 20265.0
Q2 20264.3
Q3 20265.0
Q4 20265.0

Average rating rose from 4.5 to 5.0 between Q4 2025 and Q4 2026.

Rating distribution
5 star545
4 star38
3 star24
2 star43
1 star109
Latest low reviews

Security record

12 vulnerabilities in 24 months (44 on record), all patched (latest fixed in 14.16.15).

Show 44 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
2 Oct 2026WP Statistics - Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting6.1<= 14.16.1414.16.15Patched before disclosure
1 Oct 2026WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key6.1<= 14.16.1414.16.15Patched before disclosure
24 Sep 2026WP Statistics - Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting7.2<= 14.16.1314.16.14Patched before disclosure
2 Sep 2026WP Statistics - Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting7.2<= 14.16.1114.16.12Patched before disclosure
18 Aug 2026WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter7.2<= 14.16.814.16.9Patched before disclosure
3 Aug 2026Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure4.3<= 14.16.914.16.10Patched before disclosure
1 Jun 2026WP Statistics - Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting7.2<= 14.16.614.16.7Patched before disclosure
16 Apr 2026WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation6.5<= 14.16.414.16.5Patched before disclosure
16 Apr 2026WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter7.2<= 14.16.414.16.5Patched before disclosure
26 Sep 2025WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header7.2<= 14.15.414.15.5Patched before disclosure
14 Aug 2025WP Statistics <= 14.15 - Missing Authorization4.3<= 14.1514.15.2Patched before disclosure
29 Apr 2025WP Statistics - The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update5.4<= 14.13.314.13.4Patched before disclosure
11 Mar 2024WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting7.2<= 14.514.5.1Patched before disclosure
6 Mar 2023WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection7.2<= 13.2.1614.0Patched before disclosure
31 Jan 2023WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection8.8<= 13.2.1013.2.11Patched before disclosure
27 Dec 2022WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection7.2<= 13.2.813.2.9Patched before disclosure
8 Sep 2022WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection8.8<= 13.2.513.2.6Patched before disclosure
7 Sep 2022WP Statistics <= 13.2.5 - Information Disclosure4.313.2.513.2.6Patched before disclosure
24 May 2022WP Statistics <= 13.1.7 - Cross-Site Scripting6.1< 13.2.013.2.0Patched before disclosure
11 May 2022WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting6.1< 13.2.213.2.2Patched before disclosure
17 Feb 2022WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform7.2<= 13.1.513.1.6Patched before disclosure
16 Feb 2022WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type9.8<= 13.1.513.1.61
16 Feb 2022WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP9.8<= 13.1.513.1.61
16 Feb 2022WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP7.2<= 13.1.513.1.61
16 Feb 2022WP Statistics <= 13.1.5 - Unauthenticated SQL Injection9.8<= 13.1.513.1.61

Changelog mentions of security fixes: 14.16.7 (escaping, sanitize); 14.16.8 (escaping); 14.16.9 (escaping); 14.16.10 (security); 14.16.12 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

90% of 10 support threads resolved in the last 2 months.

Momentum

500,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Statistics
4 May 202610,215
11 May 2026210,268
18 May 2026227,738
25 May 202636,996
1 Jun 202633,815
8 Jun 202621,943
15 Jun 202618,351
22 Jun 202616,381
29 Jun 202614,548
6 Jul 202613,444
13 Jul 202613,340
20 Jul 2026361,857
27 Jul 202655,804
3 Aug 202639,528
10 Aug 202624,724
17 Aug 2026184,278
24 Aug 202661,307
31 Aug 2026378,632
7 Sep 202659,431
14 Sep 2026198,603
21 Sep 202669,041
28 Sep 2026212,811
5 Oct 202660,868
12 Oct 2026378,588
19 Oct 2026221,157
26 Oct 202672,146
2 Nov 20266,604

Weekly downloads over the last 4 weeks are 53% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Pixel CatScore 100 · 40,000+Beehive AnalyticsScore 100 · 20,000+StatifyScore 100 · 20,000+Clicky AnalyticsScore 100 · 10,000+Aurora HeatmapScore 98 · 10,000+

Facts

Version14.16.18
AuthorVeronaLabs
Added20 Mar 2011
Last updated23 Oct 2026
Active installs500,000+
Requires WordPress6.6
Tested up to7.1.4
Requires PHP7.4
CategoryAnalytics & Reporting > Google Analytics Integration
TagsGDPR, stats, analytics, cookieless, google analytics

Other plugins by this author: SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce, WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS, FeedbackBird - Easily Collect Ideas, Issues, and Feedback on WordPress, SpamLens: Jev AI Spam Protection for Comments and Contact Form 7, MonoRanks - AI SEO Audit, AEO and GEO with One-Click Fixes, WConvert - Popup Builder, Email Optin Forms & Lead Capture

Questions

Is WP Statistics still maintained?

Yes. Last release 23 Oct 2026, 45 releases in the last 24 months.

Who owns WP Statistics, and has it changed hands?

No change recorded. Main committer mostafa.s1990 since Mar 2011.

Was WP Statistics removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is WP Statistics safe?

44 known vulnerabilities, all fixed (latest in 14.16.15). Not on the exploited list.

Is the latest WP Statistics update safe to install?

No ownership change before 14.16.18. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue