Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored Cross-Site Scripting via Browser Name, Referrer and Page Title
- ID
- WPSEC-2026-0774
- Plugin
- Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights (opti-behavior)
- Affected
- all versions before 1.10.0
- Remediation
- Update to 1.10.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Opti-Behavior on WPSec AttackSurface
- Fix released
- Published
Description
The Opti-Behavior plugin for WordPress is vulnerable to Stored Cross-Site Scripting via visitor-supplied tracking data, such as the browser name, referrer and page title, in all versions up to, and including, 1.9.2.1. This is due to insufficient output escaping, including of quotes, when these values are displayed on admin screens such as the Traffic browsers, referrers and top pages reports, Smart Insights, and the A/B test builder. This makes it possible for unauthenticated attackers to submit crafted tracking data that injects arbitrary web scripts, which execute whenever an administrator views the affected admin pages.
References
- https://wpsec.com/vuln/WPSEC-2026-0774/
- https://plugins.svn.wordpress.org/opti-behavior/tags/1.10.0/
- https://wordpress.org/plugins/opti-behavior/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS