Stored DOM-Based Cross-Site Scripting Vulnerability in Opti-Behavior Plugin for WordPress
CVE-2026-95686

7.2HIGH

Key Information:

Vendor

WordPress
Status
Opti-behavior – Self-hosted Heatmaps, Funnels, A/b Testing & Smart Insights
Vendor
CVE Published:
16 October 2026

What is CVE-2026-95686?

The Opti-Behavior plugin for WordPress is susceptible to Stored DOM-Based Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'targetUrl' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages accessible by users, compromising user experience and security. The potential exploit is exacerbated by a nonce that is shared publicly, permitting attackers to write malicious payloads without any authentication barriers. Users of the plugin, particularly those using versions up to and including 1.9.2.1, should take immediate action to secure their applications.

Affected Version(s)

Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights 0 <= 1.9.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/opti-behavior/...
https://plugins.trac.wordpress.org/browser/opti-behavior/...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Décio Brandão
.