CVE-2021-25020: Daan Complete Analytics Optimization Suite

Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days.

The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin

Affected products

• Daan Complete Analytics Optimization Suite: before 4.1.9 (fixed in 4.1.9)

Published 2022-01-03. Last modified 2026-06-17.