Stored DOM-Based Cross-Site Scripting in Opti-Behavior Plugin for WordPress

The Opti-Behavior plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting (XSS) due to improper input sanitization and output escaping. Affecting all versions up to and including 1.9.2.1, the vulnerability stems from the 'targetUrl' parameter within the plugin's data ingestion process. The plugin utilizes a nonce for authentication, but this nonce is publicly exposed to every anonymous visitor via the 'optiBehaviorHeatmapConfig.nonce' variable on tracked pages. Consequently, an unauthenticated attacker can retrieve this nonce and perform unauthorized write operations to the ingest endpoint, injecting arbitrary JavaScript payloads. When these injected pages are accessed by other users, including administrators, the malicious script executes within their browser context, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user who views an infected page. This can result in session theft, unauthorized modifications to site content, or administrative account takeover if an administrator visits the compromised page. The vulnerability affects all users of the Opti-Behavior plugin running version 1.9.2.1 or earlier, which is widely used for website analytics and heatmap generation.

Recommendation

• Immediately update the Opti-Behavior plugin to the latest version as provided by the vendor.
• Audit logs for suspicious POST requests to plugin-specific ingest endpoints containing script tags or event handlers in the 'targetUrl' parameter.
• Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS attacks by restricting the sources from which scripts can be executed.