Opti Behavior Self Hosted Heatmaps Funnels A B Testing Smart Insights
Monthly
Stored DOM-based cross-site scripting in the Opti-Behavior WordPress plugin (all versions up to and including 1.9.2.1) allows unauthenticated attackers to inject arbitrary JavaScript that executes when a victim later views recorded heatmap, session, or analytics data. The heatmap recording endpoint requires no authentication, and its only guard - a nonce - is freely obtainable by any anonymous visitor through the plugin's public opti_behavior_refresh_nonces AJAX action, so there is effectively no privilege barrier; the payload is stored rather than reflected, meaning it fires only when an administrator or other user loads the affected analytics page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), there is no CISA KEV entry and no public exploit code identified at time of analysis, and it should be treated as a genuine but moderate-priority issue rather than an emergency.
Stored DOM-based cross-site scripting in the WordPress plugin Opti-Behavior (Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights) through version 1.9.2.1 lets unauthenticated attackers write arbitrary script content into heatmap/analytics records via the 'targetUrl' parameter, which is later rendered into a DOM sink when a user - most plausibly an administrator viewing the heatmap analytics metabox - accesses the injected page. The write endpoint is gated only by a nonce (optiBehaviorHeatmapConfig.nonce) that the plugin itself publicly emits to every anonymous visitor on tracked pages, so no account or login of any kind is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, 7.2). Exploitation requires the plugin to be installed and active with heatmap/session tracking enabled on at least one page; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the code references in the advisory make the vulnerable paths easy to locate.
Stored DOM-based cross-site scripting in the Opti-Behavior WordPress plugin (all versions up to and including 1.9.2.1) allows unauthenticated attackers to inject arbitrary JavaScript that executes when a victim later views recorded heatmap, session, or analytics data. The heatmap recording endpoint requires no authentication, and its only guard - a nonce - is freely obtainable by any anonymous visitor through the plugin's public opti_behavior_refresh_nonces AJAX action, so there is effectively no privilege barrier; the payload is stored rather than reflected, meaning it fires only when an administrator or other user loads the affected analytics page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), there is no CISA KEV entry and no public exploit code identified at time of analysis, and it should be treated as a genuine but moderate-priority issue rather than an emergency.
Stored DOM-based cross-site scripting in the WordPress plugin Opti-Behavior (Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights) through version 1.9.2.1 lets unauthenticated attackers write arbitrary script content into heatmap/analytics records via the 'targetUrl' parameter, which is later rendered into a DOM sink when a user - most plausibly an administrator viewing the heatmap analytics metabox - accesses the injected page. The write endpoint is gated only by a nonce (optiBehaviorHeatmapConfig.nonce) that the plugin itself publicly emits to every anonymous visitor on tracked pages, so no account or login of any kind is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, 7.2). Exploitation requires the plugin to be installed and active with heatmap/session tracking enabled on at least one page; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the code references in the advisory make the vulnerable paths easy to locate.