ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) Security & Risk Analysis

The "google-analytics-dashboard-for-wp" plugin v9.0.3 exhibits a mixed security posture. While it demonstrates good practices with a high percentage of prepared SQL statements and properly escaped output, several areas raise concerns. The static analysis reveals a significant attack surface with 99 total entry points, of which 9 (approximately 9%) lack authorization checks. This is a notable weakness that could be exploited by unauthenticated attackers. Furthermore, the taint analysis identified 2 high-severity flows, indicating potential for sensitive data compromise or manipulation if not properly handled. The vulnerability history is also a significant concern, with 5 known CVEs, including 2 high-severity and 3 medium-severity vulnerabilities, predominantly related to privilege management, authorization bypass, and cross-site scripting. Although there are currently no unpatched vulnerabilities, the recurring nature and types of past issues suggest a pattern of weaknesses that require ongoing vigilance. The plugin's last reported vulnerability in 2026 is a temporal anomaly that warrants investigation, but assuming it reflects a recent occurrence, it underlines the need for robust security practices. Overall, while the plugin has strengths in its coding practices, the number of unprotected entry points, high-severity taint flows, and a history of critical vulnerability types necessitate caution and diligent monitoring.