CVE-2026-114697: WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress QA Analytics pluginto a version that resolves this vulnerability.Fixed in 5.3.0.2
Event History
Frequently Asked Questions
Which installations are affected?
QA Analytics installations running version 5.3.0.1 or earlier are affected. The issue is identified as stored cross-site scripting in the qa-heatmap-analytics plugin.
What does exploitation require?
The supplied vector indicates network-accessible exploitation with low attack complexity and no required privileges, but it requires user interaction. Successful exploitation can affect confidentiality, integrity, and availability at low impact levels.