CVE-2026-105877
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.
Risk Assessment
Sensitive data may be exposed as a result of being sent in data, potentially leading to privacy breaches or information leakage.
Recommendation
It is recommended to update the QA Analytics plugin to a version newer than 5.3.0.0 that includes a fix for the vulnerability.
Other vulnerabilities in QA Analytics
See all- CVE-2026-27544Critical
Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.
- CVE-2026-114697High
The WordPress plugin QA Analytics (qa-heatmap-analytics) up to version 5.3.0.1 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject a malicious script that executes in a user's browser.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS