Qa Analytics
Monthly
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
The QA Analytics - Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in the QA Analytics (QA Heatmap Analytics) WordPress plugin through version 5.2.0.0 lets unauthenticated attackers inject and execute arbitrary code on the hosting server, per a Patchstack advisory. The flaw is a CWE-94 code injection carrying a maximum CVSS 10.0 rating with a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but the pre-auth nature and trivial complexity make it a top-tier patching priority for any WordPress site running the plugin.
The QA Analytics - Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.