Opti-Behavior EUVD-2026-102664

Requires the Opti-Behavior plugin (v1.9.2.1 or earlier) installed and active with heatmap/session tracking enabled on at least one page, since that is what publicly emits the optiBehaviorHeatmapConfig.nonce an attacker needs and exposes the ingest endpoint. No account or authentication is required - the nonce is handed to every anonymous visitor on tracked pages - so there is effectively no authentication limit. The stored payload is injected via the 'targetUrl' parameter and reaches a DOM sink (metabox-analytics.js); execution is deferred until a user - most plausibly an administrator viewing the heatmap analytics/metabox - accesses the injected page, which is the primary limiting factor on immediate impact.

This is a genuinely notable issue rather than a high-CVSS-but-low-real-risk artifact, because the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully corroborated by the description: the write (ingest) endpoint is gated only by a nonce that the plugin itself publicly emits to every anonymous visitor via optiBehaviorHeatmapConfig.nonce, so the PR:N (unauthenticated) rating is credible and not inflated. Severity is tempered by the impact metrics - C:L/I:L/A:N with S:C - reflecting that this is stored/DOM XSS (script execution in a victim's browser context) rather than direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation; per precision rules this is 'no public exploit identified at time of analysis.' The main residual uncertainty is who the victim is: 'a user accesses an injected page' most plausibly includes the site administrator reviewing analytics/heatmap data (the DOM sink is in admin-side metabox-analytics.js), which would make this effectively a path to admin-session compromise - but the input does not explicitly confirm the victim's privilege level, so this should be verified against the Wordfence advisory. Net: treat as a real priority for sites running this plugin because exploitation requires no authentication, while noting the impact is browser-context XSS, not server RCE.

An unauthenticated attacker reads the nonce freely published in the page source (optiBehaviorHeatmapConfig.nonce) on any tracked page, then sends a crafted request to the heatmap ingest endpoint with a malicious 'targetUrl' value. The payload is stored without sanitization and later rendered into the DOM, so it executes in the browser of whoever views the injected page - likely including an administrator viewing the plugin's analytics metabox. No public exploit code was identified at time of analysis, but the attack path is straightforward given the publicly exposed nonce.