Opti-Behavior CVE-2026-95809

The Opti-Behavior plugin (versions up to and including 1.9.2.1) must be installed and active with heatmap session recording in use. Exploitation specifically abuses the unauthenticated heatmap recording AJAX endpoint, whose only protection is a nonce that any anonymous visitor can obtain through the public opti_behavior_refresh_nonces AJAX action - so there is effectively no authentication or privilege barrier. The payload is delivered through the 'country_name' location parameter and is STORED, meaning it does not execute at injection time; it fires only when a user (most impactfully an administrator) subsequently loads the page that renders the recorded heatmap/analytics data. The limiting factor is therefore deferred execution requiring a victim to later view the injected analytics page, and the scope is confined to products where this plugin is active.

This is a genuine but moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) indicates network-reachable, low-complexity, unauthenticated exploitation with a scope change, which is corroborated by the description: the heatmap recording endpoint accepts unauthenticated requests guarded only by a nonce that any visitor can freely mint via the public opti_behavior_refresh_nonces AJAX action, effectively neutralizing the nonce as a control. That lowered barrier is the single most important real-world signal and aligns well with PR:N and AC:L. However, several higher-tier signals are absent: no EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis,' not confirmed exploitation. SSVC-style framing: exploitation = none observed, automatable = likely (unauthenticated, scriptable endpoint), technical impact = partial (stored XSS, C:L/I:L, no availability loss). The practical risk is that the stored payload executes in the context of whoever later views the injected page - most consequentially an administrator reviewing heatmap analytics - enabling session/dashboard-context script execution rather than direct server compromise. Net: a real, worth-patching flaw whose severity rests on the trivially bypassable nonce, but tempered by partial impact, absence of KEV/EPSS/POC evidence, and a niche product footprint.

An unauthenticated attacker first calls the public opti_behavior_refresh_nonces AJAX action to obtain a valid nonce, then submits a crafted heatmap session-recording request setting the 'country_name' location parameter to a malicious script payload. The payload is stored and later rendered without proper escaping, so when an administrator opens the heatmap analytics view for the affected page, the script executes in their authenticated dashboard context. No public exploit code is referenced, but the attack requires no authentication and only standard HTTP requests.