An injection flaw in the QuarkA QA Analytics WordPress plugin allows stored cross‑site scripting. The plugin fails to neutralize input that is incorporated into web pages, enabling an attacker to store malicious JavaScript through a plugin field. When that stored content is later displayed to visitors, the attacker’s script executes in the victim’s browser, potentially stealing session cookies, hijacking accounts, defacing the site, or delivering further malware.

The vulnerability affects the QuarkA QA Analytics plugin for WordPress, specifically all versions up to and including 5.3.0.1. No other vendors or products are listed in the description.

The CVSS score of 7.1 indicates high impact, while EPSS data is unavailable, limiting precise exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is stored XSS: an attacker with permission to submit data to the plugin can embed a malicious payload that is later rendered for all site visitors. The risk is significant for sites that do not enforce additional controls such as content security policies, WAF rules, or input filtering.