# Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored Cross-Site Scripting via Browser Name, Referrer and Page Title

- **ID:** WPSEC-2026-0774
- **Plugin:** Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights (`opti-behavior`), https://wordpress.org/plugins/opti-behavior/
- **Affected versions:** all versions before 1.10.0
- **Fixed in:** 1.10.0 (Update to 1.10.0 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/opti-behavior
- **Fix released:** 2026-10-10
- **Published:** 2026-10-11
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0774/

## Description

The Opti-Behavior plugin for WordPress is vulnerable to Stored Cross-Site Scripting via visitor-supplied tracking data, such as the browser name, referrer and page title, in all versions up to, and including, 1.9.2.1. This is due to insufficient output escaping, including of quotes, when these values are displayed on admin screens such as the Traffic browsers, referrers and top pages reports, Smart Insights, and the A/B test builder. This makes it possible for unauthenticated attackers to submit crafted tracking data that injects arbitrary web scripts, which execute whenever an administrator views the affected admin pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-0774/
- https://plugins.svn.wordpress.org/opti-behavior/tags/1.10.0/
- https://wordpress.org/plugins/opti-behavior/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0774/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.