Live › vulnerability › CVE-2026-114697
Go to dashboardQA Analytics (qa-heatmap-analytics) <= 5.3.0.1 has unauthenticated stored XSS. WPSec names the 'event_ary' parameter as the stored input. Fixed in 5.3.0.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.
Sites running the QA Analytics qa-heatmap-analytics plugin at version 5.3.0.1 or earlier, per the NVD description. Sites without this plugin are not affected. Whether a non-admin role can store input the plugin renders is not stated in the sources.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| qa-heatmap-analytics | wordpress | <= 5.3.0.1 | 5.3.0.2 |
5.3.0.1 is affectedUpdate QA Analytics (qa-heatmap-analytics) to 5.3.0.2 or later; deactivate the plugin if you cannot update.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114697")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.