TI-2026-21938 CVE-2026-27544 · GHSA-fv8g-mjfh-5j9v
WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability
Priority MEDIUM 50
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
QuarkA
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
QuarkA records in CISA KEVNo QuarkA vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2026-86434 CVE-2026-87112 · GHSA-6gfw-3qvp-fj85
PHP object injection in QA Assistants plugin leads to code execution
Priority LOW 39
The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter.
TI-2026-69998 CVE-2026-105877 · GHSA-h86h-v9f3-5qp7
Sensitive data exposure in QuarkA QA Analytics WordPress plugin
Priority LOW 36
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
TI-2026-80060 CVE-2026-114697 · GHSA-cw6h-v858-w2h7
Stored cross-site scripting in QuarkA QA Analytics WordPress plugin
Priority LOW 31
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
TI-2024-07891 CVE-2024-8513 · GHSA-v4pc-7q3f-7vf2
QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update
Priority LOW 24
The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_conf…