DOM-Based Cross-Site Scripting Vulnerability in Opti-Behavior Plugin for WordPress

CVE-2026-95809

What is CVE-2026-95809?

The Opti-Behavior plugin for WordPress is susceptible to Stored DOM-Based Cross-Site Scripting. This vulnerability arises from inadequate input sanitization and output escaping of the 'country_name' location parameter. Attackers can leverage this flaw to insert arbitrary scripts into pages visited by users. The plugin’s heatmap recording endpoint is accessed via unauthenticated requests, making it vulnerable since the nonce required for access can be easily retrieved by any visitor through the public opti_behavior_refresh_nonces AJAX action. This creates a significant risk of malicious payload injection that could compromise user security.

References