Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
Qa Heatmap Analytics - Security Vulnerability (CVE-2026-87112)
The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The Guzzle FileCookieJar gadget present in the plugin's bundled Composer dependencies can be leveraged to perform an Arbitrary File Write, writing attacker-controlled…
PLUGIN
Qa Heatmap Analytics
CVE-2026-87112
Risk Score
Threat Entry
Updated 2026-10-26
Qa Heatmap Analytics - Security Vulnerability (CVE-2026-114697)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
PLUGIN
Qa Heatmap Analytics
CVE-2026-114697
Risk Score
Threat Entry
Updated 2026-10-09
Qa Heatmap Analytics - Security Vulnerability (CVE-2026-105877)
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
PLUGIN
Qa Heatmap Analytics
CVE-2026-105877
Risk Score
Threat Entry
Updated 2026-10-23
Qa Heatmap Analytics - Remote Code Execution (CVE-2026-27544)
Unauthenticated Remote Code Execution (RCE) in QA Analytics
PLUGIN
Qa Heatmap Analytics
CVE-2026-27544
Risk Score
Threat Entry
Updated 2026-06-17
Qa Heatmap Analytics - Broken Access Control (CVE-2024-8513)
The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_save_plugin_config() function in all versions up to, and including, 4.1.1.1. This makes it possible for unauthenticated attackers to update the plugin's settings.
PLUGIN
Qa Heatmap Analytics
CVE-2024-8513
Risk Score