Description
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.
Published: 2026-08-30
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting via AJAX in Geotargeting WP <3.5.6.2
Action: Immediate Patch
AI Analysis

Impact

The Geotargeting WP WordPress plugin prior to version 3.5.6.2 does not sanitise or escape user‑supplied parameters in its AJAX responses, which are served with an HTML content type. This allows unauthenticated attackers to inject arbitrary scripts that execute in the victim’s browser. The vulnerability is a reflected XSS, classified as CWE-79.

Affected Systems

WordPress sites running the Geotargeting WP plugin with a version older than 3.5.6.2 are affected. No vendor vendor information is available, but the plugin itself is the point of exploitation.

Risk and Exploitability

The CVSS score is 7.1. The EPSS score is below 1%, indicating a very low but nonzero exploitation probability. The bug is not listed in the CISA KEV catalog. Based on the description, it is inferred that any anonymous user can trigger the exploit by sending a crafted request to the plugin’s AJAX endpoint, making it readily exploitable from a remote location. The risk is significant due to the potential for phishing or credential compromise.

Generated by OpenCVE AI on August 31, 2026 at 15:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Geotargeting WP to version 3.5.6.2 or later.
  • If an upgrade is not immediately possible, restrict the plugin’s AJAX endpoint by firewall rules or .htaccess to deny non‑admin users.
  • Add a strong Content Security Policy that disallows inline scripts to mitigate XSS impact.

Generated by OpenCVE AI on August 31, 2026 at 15:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Geotargetingwp Project
Geotargetingwp Project geotargetingwp
Wordpress
Wordpress wordpress
Vendors & Products Geotargetingwp Project
Geotargetingwp Project geotargetingwp
Wordpress
Wordpress wordpress

Mon, 31 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 30 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Sun, 30 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Description The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.
Title Geotargeting WP < 3.5.6.2 - Reflected XSS
References

Subscriptions

Geotargetingwp Project Geotargetingwp
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-31T12:38:06.688Z

Reserved: 2026-07-01T11:16:44.235Z

Link: CVE-2026-14307

cve-icon Vulnrichment

Updated: 2026-08-31T12:31:06.187Z

cve-icon NVD

Status : Deferred

Published: 2026-08-30T07:17:20.000

Modified: 2026-08-31T20:14:36.250

Link: CVE-2026-14307

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:16:54Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')