CVE-2026-14307: Geotargeting WP < 3.5.6.2 - Reflected XSS

Q: Who can exploit this issue?

An attacker does not need to authenticate. Exploitation requires convincing a victim to submit a crafted request that reaches an affected AJAX response.

Q: What versions are affected?

Versions of the Geotargeting WP plugin before 3.5.6.2 are affected. Updating to 3.5.6.2 or later addresses the affected version range.

Q: What is required for the injected script to run?

The vulnerable AJAX responses are served with an HTML content type and reflect unsanitized parameters. A victim must be tricked into sending the attacker-crafted request for the injected script to execute in the victim's browser.

Published Aug 30, 2026

Updated

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

Affected Software

1 affected component

Geotargetingwp WordPress plugin<3.5.6.2

Event History

Aug 30, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker does not need to authenticate. Exploitation requires convincing a victim to submit a crafted request that reaches an affected AJAX response.

What versions are affected?

Versions of the Geotargeting WP plugin before 3.5.6.2 are affected. Updating to 3.5.6.2 or later addresses the affected version range.

What is required for the injected script to run?

The vulnerable AJAX responses are served with an HTML content type and reflect unsanitized parameters. A victim must be tricked into sending the attacker-crafted request for the injected script to execute in the victim's browser.