The Opti‑Behavior WordPress plugin suffers from stored DOM‑based cross‑site scripting caused by insufficient input filtering on the targetUrl parameter. The flaw allows an unauthenticated user to embed malicious web scripts which are subsequently saved and served to anyone who visits the affected page. Once executed, the injected code can steal user credentials, hijack sessions, deface content or launch phishing attacks. The weakness is a classic input validation and output encoding flaw identified as CWE‑79.

Affects all installations of the Opti‑Behavior Self‑Hosted Heatmaps, Funnels, A/B Testing & Smart Insights plugin running version 1.9.2.1 or earlier. The vulnerability is present in every release prior to and including 1.9.2.1, regardless of any other WordPress configuration.

The CVSS score of 7.2 classifies the issue as high impact. The exploitability is emphasised by the fact that the ingestion endpoint is protected only by a nonce that is emitted to every visitor; no authentication is required to write a payload. Because the nonce can be obtained by simply viewing any tracked page, an attacker can craft requests that store the malicious payload. The EPSS score is approximately 0.28% and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and lack of authentication requirements indicate a significant risk of real‑world exploitation.