SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

374 searches this plugin appeared in over the last 90 days, 20 listed. 287 left out as unrelated or noise (years, numbers, stray words). 2 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 5 months ago; a band this size takes about a year or more to cross, which places it about 61% of the way through.

1. ★★★★★ sperorisk

   7mo ago

   A recent update didn’t go well for me, but Parham and the support team worked diligently (and seemingly tirelessly) to investigate and solve the problem. (If you’ve seen a few recent updates, I’ll take credit for those.) I’ve used SlimStat for many, many years, and don’t know a better way of getting a sense of who is visiting the site. This was the first time that I had an issue, and I’m amazed at how much time and energy they devoted to my problem (for my meager $39/year). Everyone thinks there’s just WordPress, but there are thousands of different plugins and just as many server settings and, therefore, millions of different configurations that could cause problems. If you have a problem, these guys will work with you to solve it. It’s the best stats plugin that I used, and the best support team that I’ve needed. (Thanks guys!)

   Read on wp.org ↗
2. ★★★★★ strandpuller

   7mo ago

   I had trouble getting the browser cap to stay on. I contacted SlimStat support, and they were exceptionally helpful in solving the problem. They worked with me repeatedly until the browser cap problem was fixed. I am impressed with the quality of support they provided.

   Read on wp.org ↗
3. ★★★★★ Ryan

   8mo ago

   the lastest update Version 5.4.1 is the worst I have ever used. This topic was modified 4 months, 1 week ago by Ryan.

   Read on wp.org ↗
4. ★★★★★ alamea

   1.1y ago

   fantastic plugin, fast and good filter options

   Read on wp.org ↗
5. ★★★★★ Marcia

   1.5y ago

   Last update to version 5.4 made the site slow and causing 503 errors. This is terrible. Every time you change something, you break everything. I uninstalled it and will get a better competitor. This topic was modified 1 year, 2 months ago by Marcia. This topic was modified 4 months, 1 week ago by Marcia.

   Read on wp.org ↗
6. ★★★★★ lweb

   1.5y ago

   Everything became chargeable overnight. So I uninstalled this plugin from my 72 sites. Goodbye, Slimstat

   Read on wp.org ↗
7. ★★★★★ Senri Miura

   2.4y ago

   I installed this as an alternative to NewStatPress, which is no longer being maintained.Thank you for providing such a great plugin.SlimStat Analytics is an excellent plugin that is easy to use and has many functions, but I would like it to be even better if the widget could display page views (yesterday, today), etc.

   Read on wp.org ↗
8. ★★★★★ craig.keefner

   2.8y ago

   Nice data and super lightweight on site. Good for seeing clickthru data. I also use Postview. The only downside to the plugin is I run my servers at WP Engine and they still call out the CVE related to 5.0.9 which was shortcode. That was fixed two iterations ago but WPE still considers it unfixed. Getting their engineering team to review it has been a month with no progress. That also says something about the security database at WPE for that matter (ie out of date?).

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-24 Version 6.0.0 SlimStat 6: see where visitors click, which campaigns bring sales, and trust every number. Your settings and data carry over, migration steps wait for your click, and older versions keep working if you ever go back. New 6.0.0
2. 2026-06-24 Version 5.5.0 Feature: New Goals & Funnels page (slimview6) — define goals and funnels in a modern card layout with pill-segmented funnel tabs, a side drawer for goal create/edit, an overlay builder for funnels, and a destructive-acti 5.5.0
3. 2026-05-13 Version 5.4.12 Security: Authenticated SQL injection in the chart AJAX endpoint (slimstat_fetch_chart_data) is now blocked. The chart_data.where parameter is validated against the trusted report registry before reaching the query layer 5.4.12
4. 2026-04-17 Version 5.4.11 Fix: Access Log pagination no longer drops the user’s selected custom date range Fix: Auto Refresh setting in Settings → Reports is now honored Fix: Recent panels now show unique items instead of duplicating the same ent 5.4.11
5. 2026-04-03 Version 5.4.9 Fix: Scoped sortable handler to Slimstat Customize page only — prevents corrupting WordPress Dashboard widget layout Fix: Use sanitized URI in dashboard widget enqueue condition for consistency 5.4.9
6. 2026-03-31 Version 5.4.8 This release fixes remaining tracking issues from the 5.4.x upgrade cycle. If you upgraded from 5.3.x through 5.4.0-5.4.6, this update restores session cookies and client-side tracking automatically. Fix: Session cookies 5.4.8

All 28 disclosed vulnerabilities are patched in the current version (6.0.0). Sites still on an older version should update.

1. Patched High · 7.2 SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-29 CVE-2026-12592 Improper Neutralization of Input During Web Page Generation Affects <= 5.4.0 Patched in 5.5.0
2. Patched Medium · 6.5 SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection ↗
   2026-06-17 CVE-2026-54818 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.4.11 Patched in 5.4.12
3. Patched High · 8.1 SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection ↗
   2026-06-01 CVE-2026-27410 Deserialization of Untrusted Data Affects < 5.4.0 Patched in 5.4.0
4. Patched High · 7.2 SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header ↗
   2026-05-27 CVE-2026-7634 Improper Neutralization of Input During Web Page Generation Affects <= 5.4.11 Patched in 5.4.12
5. Patched High · 7.2 SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh' ↗
   2026-03-18 CVE-2026-1238 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.5 Patched in 5.4.0
6. Patched Medium · 6.5 SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter ↗
   2026-02-10 CVE-2025-13431 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.3.1 Patched in 5.3.2
7. Patched Medium · 6.1 Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting ↗
   2026-01-27 CVE-2025-69323 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.2 Patched in 5.3.3
8. Patched High · 7.2 SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter ↗
   2026-01-08 CVE-2025-15057 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.3 Patched in 5.3.4
9. Patched High · 7.2 SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters ↗
   2026-01-08 CVE-2025-15055 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.4 Patched in 5.3.5
10. Patched High · 7.2 SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2025-12-18 CVE-2025-14151 Improper Neutralization of Input During Web Page Generation Affects <= 5.3.2 Patched in 5.3.3
11. Patched High · 7.2 Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-10-14 CVE-2024-9548 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.6 Patched in 5.2.7
12. Patched Medium · 6.4 SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-02-01 CVE-2024-1073 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.3 Patched in 5.1.4
13. Patched High · 8.8 Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode ↗
    2023-09-11 CVE-2023-4598 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.0.9 Patched in 5.0.10
14. Patched Medium · 6.4 Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-08-28 CVE-2023-4597 Improper Neutralization of Input During Web Page Generation Affects <= 5.0.9 Patched in 5.0.10
15. Patched Medium · 4.4 Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings ↗
    2023-08-22 CVE-2023-40676 Improper Neutralization of Input During Web Page Generation Affects <= 5.0.8 Patched in 5.0.9
16. Patched Medium · 4.3 Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview ↗
    2023-08-22 CVE-2023-33994 Missing Authorization Affects <= 5.0.5.1 Patched in 5.0.6
17. Patched High · 7.2 Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection ↗
    2023-05-11 CVE-2022-45373 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.0.4 Patched in 5.0.5
18. Patched Medium · 6.1 Slimstat Analytics <= 5.0.4 - Reflected Cross-Site Scripting ↗
    2023-05-11 CVE-2022-45366 Improper Neutralization of Input During Web Page Generation Affects <= 5.0.4 Patched in 5.0.5
19. Patched High · 8.8 Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via Shortcode ↗
    2023-03-30 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.3.3 Patched in 4.9.3.4
20. Patched High · 8.8 Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode ↗
    2023-02-23 CVE-2023-0630 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.9.3.2 Patched in 4.9.3.3
21. Patched High · 7.2 Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2022-12-19 CVE-2022-4310 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.2 Patched in 4.9.3
22. Patched Medium · 6.1 Slimstat Analytics <= 4.9.2 - Reflected Cross-Site Scripting via REQUEST_URI ↗
    2022-12-12 Improper Neutralization of Input During Web Page Generation Affects <= 4.9.2 Patched in 4.9.3
23. Patched High · 8.8 Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting ↗
    2019-05-22 Cross-Site Request Forgery Affects < 4.8.4 Patched in 4.8.4
24. Patched Medium · 6.1 WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors ↗
    2019-05-21 CVE-2019-15112 Improper Neutralization of Input During Web Page Generation Affects <= 4.8 Patched in 4.8.1
25. Patched Medium · 6.1 Slimstat Analytics < 4.1.6.1 - Cross-Site Scripting ↗
    2015-07-22 CVE-2015-9273 Improper Neutralization of Input During Web Page Generation Affects < 4.1.6.1 Patched in 4.1.6.1
26. Patched High · 8.2 Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection ↗
    2015-02-24 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.9.6 Patched in 3.9.6
27. Patched Medium · 6.1 Slimstat Analytics <= 3.5.5 - Stored Cross-Site Scripting ↗
    2015-01-13 CVE-2014-100027 Improper Neutralization of Input During Web Page Generation Affects < 3.5.6 Patched in 3.5.6
28. Patched Medium · 6.1 Slimstat Analytics <= 3.9.2 - Cross-Site Scripting ↗
    2015-01-06 CVE-2015-1204 Improper Neutralization of Input During Web Page Generation Affects < 3.9.3 Patched in 3.9.3

Translated into 58 languages, 0 at 90% or more

Plus 34 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-11 80K+ → 70K+ down after 255 days in tier
2. 2025-09-29 90K+ → 80K+ down after 633 days in tier
3. 2024-01-05 100K+ → 90K+ down after 3194 days in tier
4. 2015-04-08 80K+ → 100K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce into a readme, a review or a deck. It updates itself.

SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce: 70K+ active installs, 4.8★ (816 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/wp-slimstat