CVE-2026-114697
HighCVSS 7.1Summary
The WordPress plugin QA Analytics (qa-heatmap-analytics) up to version 5.3.0.1 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject a malicious script that executes in a user's browser.
Risk Assessment
Stored XSS could allow an attacker to steal session cookies, hijack user accounts, or perform actions on behalf of the victim. This could compromise the security of the entire website.
Recommendation
Update the QA Analytics plugin to the latest version (above 5.3.0.1). Additionally, consider implementing security headers such as Content Security Policy.
Other vulnerabilities in QA Analytics
See all- CVE-2026-27544Critical
Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.
- CVE-2026-105877Medium
The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS