Plausible Analytics vulnerabilities

Latest Plausible Analytics CVEs

Newest publication first

1. CVE-2026-119565 Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

   Published 2026-10-30

   Medium·CVSS 5.3 EPSS 0.31%

   Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to ano...

2. CVE-2026-119564 Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs

   Published 2026-10-30

   Medium·CVSS 6.0 EPSS 0.29%

   Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID...

3. CVE-2023-40553 WordPress Plausible Analytics Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-09-06

   Medium·CVSS 6.1 EPSS 0.34%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Plausible.Io Plausible Analytics plugin <= 1.3.3 versions.

4. CVE-2022-27845 WordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

   Published 2022-04-11

   Medium·CVSS 4.8 EPSS 0.85%

   Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.