{
 "id": "WPSEC-2026-0774",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0774/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0774/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0774/index.md",
 "title": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored Cross-Site Scripting via Browser Name, Referrer and Page Title",
 "description": "The Opti-Behavior plugin for WordPress is vulnerable to Stored Cross-Site Scripting via visitor-supplied tracking data, such as the browser name, referrer and page title, in all versions up to, and including, 1.9.2.1. This is due to insufficient output escaping, including of quotes, when these values are displayed on admin screens such as the Traffic browsers, referrers and top pages reports, Smart Insights, and the A/B test builder. This makes it possible for unauthenticated attackers to submit crafted tracking data that injects arbitrary web scripts, which execute whenever an administrator views the affected admin pages.",
 "plugin": {
  "slug": "opti-behavior",
  "name": "Opti-Behavior",
  "full_name": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights",
  "wordpress_org": "https://wordpress.org/plugins/opti-behavior/",
  "advisories_url": "https://wpsec.com/vuln/plugin/opti-behavior/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/opti-behavior"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.10.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.10.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.10.0",
 "remediation": "Update to 1.10.0 or later.",
 "fix_released": "2026-10-10T18:26:27+00:00",
 "published": "2026-10-11T18:45:56+00:00",
 "updated": "2026-10-11T11:41:42.353245+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0774/",
  "https://plugins.svn.wordpress.org/opti-behavior/tags/1.10.0/",
  "https://wordpress.org/plugins/opti-behavior/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/opti-behavior",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-12"
 }
}