CVE-2026-95686 in Opti-Behavior Plugin
Summary
by MITRE • 10/16/2026
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The Opti-Behavior plugin for WordPress, which provides self-hosted heatmaps, session recordings, funnels, A/B testing, and smart insights capabilities, contains a critical security flaw affecting all versions up to 1.9.2.1. This vulnerability is classified as a Stored DOM-Based Cross-Site Scripting (XSS) issue rooted in insufficient input sanitization and output escaping mechanisms within the application logic. The specific point of failure occurs when processing the targetUrl parameter, which allows an attacker to inject arbitrary web scripts into the system. Unlike reflected XSS where malicious payloads are delivered via links or forms that execute immediately upon user interaction with a crafted request, stored vulnerabilities persist on the server side and are served back to victims during normal operation, significantly increasing the potential blast radius of the attack.
The operational impact of this vulnerability is severe due to the authentication model employed by the plugin's data ingestion endpoint. Typically, endpoints handling sensitive analytics or configuration data require some form of user authentication or capability checks to prevent unauthorized modifications. However, in this case, access control relies solely on a nonce value that is publicly emitted to every anonymous visitor via the optiBehaviorHeatmapConfig.nonce variable embedded in tracked pages. This design flaw effectively removes any barrier for unauthenticated attackers, allowing them to interact with the ingest endpoint without needing valid credentials or existing sessions. Consequently, an attacker can easily retrieve this public nonce and use it to submit malicious payloads that will be stored within the application's data structures.
Once a payload is successfully injected through the targetUrl parameter, it remains in the system until manually removed by an administrator. When any user subsequently accesses pages where these analytics are rendered or processed, the browser executes the embedded JavaScript code as part of the page load process. This execution context grants the attacker significant leverage to perform actions on behalf of the victim, such as stealing session cookies, capturing sensitive input data like login credentials, performing unauthorized administrative actions if the victim has elevated privileges, or redirecting users to phishing sites. The persistent nature of stored XSS makes it particularly dangerous because victims may interact with the compromised content multiple times over an extended period without realizing they are being targeted.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the subcategory for stored variants where data is saved to a database or persistent storage before being retrieved later. In terms of adversary tactics, this exploitation technique maps directly to ATT&CK T1059 Command and Control using JavaScript, allowing attackers to execute arbitrary code within the victim's browser environment. It also relates to ATT&CK T1204 User Execution if the attack relies on tricking users into clicking specific links or visiting compromised pages that trigger the stored payload delivery mechanism.
Mitigation strategies should focus primarily on immediate remediation through software updates and secondary hardening of input handling practices. The most effective solution is to upgrade the Opti-Behavior plugin to a version newer than 1.9.2.1, where developers have presumably addressed the sanitization and escaping deficiencies in the targetUrl parameter processing logic. Until an update can be applied, administrators should consider disabling the heatmap or session recording features if they are not strictly necessary for business operations, thereby removing the attack surface entirely. Additionally, implementing strict Content Security Policy headers that restrict script execution to trusted sources only can help mitigate the impact of any successfully injected scripts by preventing them from executing even if they reach the browser. Regular security audits and code reviews focusing on how user-supplied data is handled in AJAX endpoints are essential for preventing similar vulnerabilities in future development cycles, ensuring that authentication checks are robust and not bypassed by publicly accessible tokens alone.