QuarkA vulnerabilities

Products

• QA Analytics 4
• QA Assistants – Driven by data 2

Latest QuarkA CVEs

Newest publication first

1. CVE-2026-87112 QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters

   Published 2026-11-07

   High·CVSS 8.8 EPSS 0.80%

   The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without a...

2. CVE-2026-114697 WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-24

   High·CVSS 7.1 EPSS 0.21%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.

3. CVE-2026-105877 WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability

   Published 2026-10-09

   Medium·CVSS 6.9 EPSS 0.25%

   Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.

4. CVE-2026-27544 WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

   Published 2026-08-13

   Critical·CVSS 10.0 EPSS 0.86%

   Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

5. CVE-2024-8513 QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update

   Published 2024-10-10

   Medium·CVSS 5.3 EPSS 0.42%

   The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_config() function in all versions up to, and including, 4.1.1.1....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.