The Opti-Behavior plugin for WordPress has a Stored DOM-Based Cross-Site Scripting vulnerability via the 'country_name' Location Parameter. This allows unauthenticated attackers to inject web scripts that execute when a user accesses an injected page. The vulnerability is confirmed in Opti-Behavior plugin versions up to 1.9.2.1. The heatmap recording endpoint accepts unauthenticated requests protected onl [truncated]
The Opti-Behavior plugin for WordPress has a Stored DOM-Based Cross-Site Scripting vulnerability via the 'targetUrl' parameter in versions up to 1.9.2.1. This allows unauthenticated attackers to inject web scripts that execute when a user accesses an injected page. The vulnerability is caused by insufficient input sanitization and output escaping. The ingest endpoint is gated only by a nonce that is publi [truncated]
