CVE-2026-95686

7.2High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can inject persistent web scripts that execute in visitors' browsers, requiring only network access to tracked WordPress pages. Because the ingest endpoint relies on a public nonce exposed to all anonymous visitors, no account is needed to store the payload.

Root cause

The plugin fails to sanitize and escape the 'targetUrl' parameter before storing and rendering it into the DOM.

Affected systems

Opti-Behavior WordPress plugin through version 1.9.2.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Opti-Behavior to a version newer than 1.9.2.1 once published, or deactivate and remove the plugin immediately if an update is not yet available.

shell

$ wp plugin deactivate opti-behavior

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-95686