CVE-2026-27544
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.
Risk Assessment
An attacker can take control of the server, steal data, or install malware.
Recommendation
Update QA Analytics to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in QA Analytics
See all- CVE-2026-114697High
The WordPress plugin QA Analytics (qa-heatmap-analytics) up to version 5.3.0.1 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject a malicious script that executes in a user's browser.
- CVE-2026-105877Medium
The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS