SlimStat Analytics

84 Quality Score

Active Installs

22/30

With around 70,000 active installs, SlimStat sits well below category leaders like WP Statistics (600,000) and Site Kit (5,000,000), which drags its popularity score, though it is solid within its privacy-focused niche.

Update Freshness

25/25

The plugin was updated within days of this review and reports full compatibility with WordPress 7.0, signaling an actively maintained codebase.

User Rating

14/15

A 96 out of 100 rating across 816 reviews reflects strongly positive user sentiment.

Support Health

8/15

Only one support thread exists in the dataset with a 100 percent resolution rate, which is encouraging but too small a sample to draw firm conclusions about support responsiveness.

WP Compatibility

15/15

Full marks here, with WordPress 7.0 tested and PHP 7.4 as the minimum, covering an enormous share of installed WordPress environments.

Scores higher than 93% of indexed plugins

About

Real-time WordPress analytics that stay on your own server: pageviews, outbound links, WooCommerce funnels, all privacy-first and GDPR-ready.

Active Installs 70k+

Rating ★★★★½ 4.8/5

Last Updated 2026-06-24 8:58am GMT

Requires WordPress 5.6+

Tested Up To 7.0.4

Requires PHP 7.4+

Security History

28 known vulnerabilities, all patched

15 High 13 Medium

Most recent: June 29, 2026

View details ▸

SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting High

June 29, 2026 Patched in ["5.5.0"] CVE-2026-12592

SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection Medium

June 17, 2026 Patched in ["5.4.12"] CVE-2026-54818

SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection High

June 1, 2026 Patched in ["5.4.0"] CVE-2026-27410

SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header High

May 27, 2026 Patched in ["5.4.12"] CVE-2026-7634

SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh' High

March 18, 2026 Patched in ["5.4.0"] CVE-2026-1238

SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter Medium

February 10, 2026 Patched in ["5.3.2"] CVE-2025-13431

Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting Medium

January 27, 2026 Patched in ["5.3.3"] CVE-2025-69323

SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter High

January 8, 2026 Patched in ["5.3.4"] CVE-2025-15057

SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters High

January 8, 2026 Patched in ["5.3.5"] CVE-2025-15055

SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting High

December 18, 2025 Patched in ["5.3.3"] CVE-2025-14151

Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting High

October 14, 2024 Patched in ["5.2.7"] CVE-2024-9548

SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

February 1, 2024 Patched in ["5.1.4"] CVE-2024-1073

Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode High

September 11, 2023 Patched in ["5.0.10"] CVE-2023-4598

Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

August 28, 2023 Patched in ["5.0.10"] CVE-2023-4597

Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings Medium

August 22, 2023 Patched in ["5.0.9"] CVE-2023-40676

Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview Medium

August 22, 2023 Patched in ["5.0.6"] CVE-2023-33994

Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection High

May 11, 2023 Patched in ["5.0.5"] CVE-2022-45373

Slimstat Analytics <= 5.0.4 - Reflected Cross-Site Scripting Medium

May 11, 2023 Patched in ["5.0.5"] CVE-2022-45366

Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via Shortcode High

March 30, 2023 Patched in ["4.9.3.4"]

Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode High

February 23, 2023 Patched in ["4.9.3.3"] CVE-2023-0630

Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting High

December 19, 2022 Patched in ["4.9.3"] CVE-2022-4310

Slimstat Analytics <= 4.9.2 - Reflected Cross-Site Scripting via REQUEST_URI Medium

December 12, 2022 Patched in ["4.9.3"]

Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting High

May 22, 2019 Patched in ["4.8.4"]

WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors Medium

May 21, 2019 Patched in ["4.8.1"] CVE-2019-15112

Slimstat Analytics < 4.1.6.1 - Cross-Site Scripting Medium

July 22, 2015 Patched in ["4.1.6.1"] CVE-2015-9273

Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection High

February 24, 2015 Patched in ["3.9.6"]

Slimstat Analytics <= 3.5.5 - Stored Cross-Site Scripting Medium

January 13, 2015 Patched in ["3.5.6"] CVE-2014-100027

Slimstat Analytics <= 3.9.2 - Cross-Site Scripting Medium

January 6, 2015 Patched in ["3.9.3"] CVE-2015-1204

What It Does

SlimStat Analytics is a self-hosted WordPress analytics plugin that tracks pageviews, outbound clicks, and WooCommerce conversion funnels directly in your own database, avoiding third-party data sharing. It includes geolocation, real-time reporting, and is built around GDPR-friendly defaults such as cookieless tracking and IP anonymization.

Who It's For

This plugin is best for privacy-conscious site owners, particularly small WooCommerce stores and independent content creators, who want actionable on-site analytics without sending visitor data to Google or other third parties. It suits users comfortable with a WordPress-native dashboard rather than a polished external UI.

Who Should Skip It

If you need the deep integration with Google Search Console, AdSense, and Tag Manager that Site Kit provides, or if you run a high-traffic publisher site where proven scale matters more than data sovereignty, look elsewhere.

The Bottom Line

SlimStat Analytics delivers exactly what it promises: usable, self-hosted analytics with strong WooCommerce and GDPR-friendly defaults, scoring 83.6 out of 100 on PluginCheck. Its smaller install base and thin public support footprint are real caveats, but the rating and maintenance signals are excellent for a privacy-focused store or creator site.

Related Plugins

Site Kit by Google 94/100

Pick Site Kit if you want first-party Google Analytics 4, Search Console, and AdSense data pulled directly into your WordPress dashboard.

Burst Statistics 93/100

Pick Burst if you want a similar cookieless, privacy-first experience with a more modern UI and broader install base.

Independent Analytics 92/100

Pick Independent Analytics if you want GA-style reports inside WordPress using a simple Google Analytics 4 property as a data source.

Matomo Analytics 91/100

Pick Matomo when you need enterprise-grade privacy analytics with heatmaps, A/B testing, and richer funnel analysis.

WP Statistics 91/100

Pick WP Statistics for a larger community, more frequent updates, and a comparable self-hosted analytics feature set.

Compare SlimStat Analytics

SlimStat Analytics vs MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) 95/100

SlimStat Analytics vs Site Kit by Google – Analytics, Search Console, AdSense, Speed 94/100

SlimStat Analytics vs Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) 93/100