---
id: CVE-2026-95809
title: >-
  The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B
  Testing & Smart Insights plugin for WordPress is vulnerable to Stored
  DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all
  versions up to, …
summary: >-
  The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B
  Testing & Smart Insights plugin for WordPress is vulnerable to Stored
  DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all
  versions up to, …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: optiuser
product: 'Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights'
affected:
  - >-
    opti-behavior_self-hosted_heatmaps_funnels_a_b_testing_smart_insights <=
    1.9.2.1
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:17:37.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95809'
references:
  - url: 'https://plugins.svn.wordpress.org/opti-behavior/'
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L1603
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-ajax-handler.php#L2656
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/admin/class-opti-behavior-heatmap-post-metabox.php#L1498
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/assets/js/metabox-analytics.js#L668
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/opti-behavior/tags/1.9.0/includes/class-opti-behavior-heatmap-session.php#L369
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3738510/opti-behavior/trunk/assets/js/metabox-analytics.js
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/6c631593-4857-46c8-80b3-d028524cb86c?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00247
epssPercentile: 0.15879
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T14:34:28.414682Z'
ingestedAt: '2026-10-16T06:00:00.394Z'
---

## Overview

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The heatmap recording endpoint accepts unauthenticated requests protected only by a nonce that any visitor can freely obtain via the public opti_behavior_refresh_nonces AJAX action, removing any practical barrier to injecting the malicious payload.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.