Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: QuarkA Clear all filters
TI-2026-86434 CVE-2026-87112 · GHSA-6gfw-3qvp-fj85

PHP object injection in QA Assistants plugin leads to code execution

Priority MEDIUM 41

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00795 Published 2026-11-07 No fix listed CWE-502
TI-2026-80060 CVE-2026-114697 · GHSA-cw6h-v858-w2h7

Stored cross-site scripting in QuarkA QA Analytics WordPress plugin

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00205 Published 2026-10-24 No fix listed CWE-79
TI-2026-69998 CVE-2026-105877 · GHSA-h86h-v9f3-5qp7

Sensitive data exposure in QuarkA QA Analytics WordPress plugin

Priority LOW 36

Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00253 Published 2026-10-09 No fix listed CWE-201
TI-2024-07891 CVE-2024-8513 · GHSA-v4pc-7q3f-7vf2

QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update

Priority LOW 24

The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_conf…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00423 Published 2024-10-10 No fix listed CWE-862