The vulnerability in the Opti‑Behavior plugin allows unauthenticated attackers to store malicious JavaScript in the application via the 'country_name' parameter sent to a heatmap recording endpoint. The lack of input sanitization and output escaping makes the injected payload persist and execute in any browser that loads the affected page, potentially exposing user data, hijacking sessions, or defacing content (these outcomes are inferred from the described impact, not directly stated).

WordPress installations that have the Opti‑Behavior plugin version 1.9.2.1 or earlier, including all versions up to and including 1.9.2.1.

With a CVSS score of 7.2, the vulnerability poses a significant risk, especially given that the required nonce can be obtained by any visitor via the public AJAX action and there is no practical authentication barrier. The EPSS score indicates that the probability of exploitation is below 1%, and the flaw is not listed in CISA's KEV catalog, but the combination of unauthenticated access and stored payloads means exploitation is straightforward for attackers who discover the endpoint.