Vulnerability feed

Executive summary

A cross-site scripting flaw in the QA Analytics WordPress plugin, versions 5.3.0.1 and earlier, lets attackers inject malicious scripts into affected websites. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The recommended action is to update the plugin to version 5.3.0.2 or later.

Technical summary

This is a stored cross-site scripting (XSS) vulnerability, classified under OWASP A3: Injection, in the QA Analytics plugin for WordPress. The advisory states that vulnerable versions are 5.3.0.1 and earlier and that the patched version is 5.3.0.2. Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form, while the attacker needs no authentication. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, but the advisory does not describe other workarounds. Detection guidance beyond the mitigation rule is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affects

QuarkAPatchstackQuarkA QA AnalyticsPatchstack QA Analytics