CVE-2026-105877
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.
Risk Assessment
Sensitive data may be exposed as a result of being sent in data, potentially leading to privacy breaches or information leakage.
Recommendation
It is recommended to update the QA Analytics plugin to a version newer than 5.3.0.0 that includes a fix for the vulnerability.
Other vulnerabilities in QA Analytics
See all- CVE-2026-114697High
The WordPress plugin QA Analytics (qa-heatmap-analytics) up to version 5.3.0.1 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject a malicious script that executes in a user's browser.
- CVE-2026-27544Critical
Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS