CVE-2026-95686
validatedZero produced an exploit or a check.GHSA-x53h-w4xx-wqx7 ↗EUVD-2026-102664 ↗
description
Opti-Behavior for WordPress versions through 1.9.2.1 can retain attacker-controlled data that is interpreted as script in a visitor’s browser. An unauthenticated attacker can abuse the tracking submission path after obtaining the nonce exposed on a tracked public page; the script runs when someone visits the affected page.
mitigation
Disable the Opti-Behavior plugin or restrict public access to its tracking submission endpoint until a vendor update is available. Monitor the vendor’s releases and upgrade promptly when a fixed version is published.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-16 05:30Zghsa: trigger signal, started the run
- 2026-10-16 05:30Zcve.org record for CVE-2026-95686
- 2026-10-20 23:02Z
this entry in the feed
GET /api/v1/feed/CVE-2026-95686
{ "etk_id": "ETK-2026-1923", "cve_id": "CVE-2026-95686", "display_id": "CVE-2026-95686", "ghsa_id": "GHSA-x53h-w4xx-wqx7", "euvd_id": "EUVD-2026-102664", "status": "published", "anchor_state": "anchored", "title": "Stored DOM XSS in Opti-Behavior WordPress plugin", "summary": "Opti-Behavior for WordPress versions through 1.9.2.1 can retain attacker-controlled data that is interpreted as script in a visitor’s browser. An unauthenticated attacker can abuse the tracking submission path after obtaining the nonce exposed on a tracked public page; the script runs when someone visits the affected page.", "mitigation": "Disable the Opti-Behavior plugin or restrict public access to its tracking submission endpoint until a vendor update is available. Monitor the vendor’s releases and upgrade promptly when a fixed version is published.", "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.9.2.1" ], "ecosystem": null, "fixed_versions": [], "package_name": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "purl": null } ], "cwes": null, "cvss_score": 7.2, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "epss_score": 0.0028, "epss_percentile": 0.1904, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.0113, "t0_at": "2026-10-16T05:30:21.426000+00:00", "signals": { "check": { "at": "2026-10-20T23:02:48.995552+00:00", "days": 4.730874647592593, "is_lower_bound": false, "measured_at": "2026-10-16T05:30:21.426000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-16T05:30:21.426000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-16T05:30:21.426000+00:00", "url": "https://github.com/advisories/GHSA-x53h-w4xx-wqx7" } } }
published 2026-10-18 02:02Z
last change 2026-10-21 00:18Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.