{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/opti-behavior/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opti-behavior:opti-behavior:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-95686"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Opti-Behavior (\u003c= 1.9.2.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Opti-Behavior"],"content_html":"\u003cp\u003eThe Opti-Behavior plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting (XSS) due to improper input sanitization and output escaping. Affecting all versions up to and including 1.9.2.1, the vulnerability stems from the 'targetUrl' parameter within the plugin's data ingestion process. The plugin utilizes a nonce for authentication, but this nonce is publicly exposed to every anonymous visitor via the 'optiBehaviorHeatmapConfig.nonce' variable on tracked pages. Consequently, an unauthenticated attacker can retrieve this nonce and perform unauthorized write operations to the ingest endpoint, injecting arbitrary JavaScript payloads. When these injected pages are accessed by other users, including administrators, the malicious script executes within their browser context, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user who views an infected page. This can result in session theft, unauthorized modifications to site content, or administrative account takeover if an administrator visits the compromised page. The vulnerability affects all users of the Opti-Behavior plugin running version 1.9.2.1 or earlier, which is widely used for website analytics and heatmap generation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Opti-Behavior plugin to the latest version as provided by the vendor.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious POST requests to plugin-specific ingest endpoints containing script tags or event handlers in the 'targetUrl' parameter.\u003c/li\u003e\n\u003cli\u003eImplement strict Content Security Policy (CSP) headers to mitigate the impact of XSS attacks by restricting the sources from which scripts can be executed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:28:51Z","date_published":"2026-10-16T06:28:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-opti-behavior-xss/","summary":"An unauthenticated stored DOM-based XSS vulnerability (CVE-2026-95686) in the Opti-Behavior plugin for WordPress allows attackers to inject malicious scripts via a publicly accessible nonce-protected ingest endpoint.","title":"Stored DOM-Based Cross-Site Scripting in Opti-Behavior Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-10-opti-behavior-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Opti-Behavior","version":"https://jsonfeed.org/version/1.1"}