WordPress Plugin Vulnerabilities

Geotargeting WP < 3.5.6.2 - Reflected XSS

Description

The plugin does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

Proof of Concept

Affects Plugins

Plugin icon
geotargetingwp
Fixed in 3.5.6.2

References

CVE
CVE-2026-14307

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
andrew gomez
Submitter
andrew gomez
Submitter website
https://reddarkin.com/
Submitter twitter
red_darkin
Verified
Yes
WPVDB ID
5f55b592-9113-47d1-8b48-6ba785c0834a

Timeline

Publicly Published
2026-08-28 (about 2 days ago)
Added
2026-08-28 (about 1 day ago)
Last Updated
2026-08-28 (about 1 day ago)

Other

Published
Title
Published
2023-05-12
Title
Sunny Search <= 1.0.2 - Admin+ Stored XSS
Published
2026-07-21
Title
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2023-06-09
Title
GD Mail Queue < 4.0 - Unauthenticated Stored Cross-Site Scripting
Published
2024-07-16
Title
AI ChatBot for WordPress – WPBot < 5.5.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-12-03
Title
SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload