QA Analytics EUVD-2026-109253

Exploitation requires the attacker to get a script payload stored by the QA Analytics plugin and then requires a victim user to load the page where that stored payload is rendered (UI:R in the vector) - so it is not a zero-click flaw. The available sources do not identify the specific input field, feature, or page used to inject or render the payload, so the exact storage surface is undocumented. The input vector lists PR:N (no privileges), but stored XSS typically depends on access to a surface that persists attacker input; because the trigger is not described in the available sources, defenders should confirm whether an authenticated account or a public submission form is needed. Limiting factors: mandatory victim interaction, dependence on a user with access to the rendered page viewing it, and the plugin being installed and active on affected versions (through 5.3.0.1).

This is a stored cross-site scripting (CWE-79) flaw in the QA Analytics (qa-heatmap-analytics) WordPress plugin, affecting all versions up to and including 5.3.0.1, reported by Patchstack. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) indicates network reach, low complexity, no required privileges, but mandatory user interaction and a scope change (payload executing in the victim's browser context). No EPSS score was supplied, the CVE is not on the CISA KEV list, and no public exploit or PoC reference is present in the input - only the Patchstack advisory. The vuln.today decision label is 'this_week', which is a prioritize-and-schedule signal rather than act_now/emergency. Taken together, these signals describe a genuine but moderate-priority issue: a real XSS worth patching on a normal cycle, not a mass-exploited emergency. One caveat to verify: the input vector states PR:N (unauthenticated), yet stored XSS normally requires some ability to persist input (an account or a public submission surface); the available sources do not describe the injection point, so the true privilege requirement should be confirmed with Patchstack/the vendor.

An attacker injects a malicious script into a plugin input field that QA Analytics stores and later renders without proper neutralization; when a site administrator or other user subsequently views the affected page, the script executes in their browser session. Because the CVSS scope is changed (S:C), the payload runs in the victim's browser context and could act on their session. No public exploit code is identified in the available sources, and exploitation requires a victim to load the affected page (UI:R).