CVE-2026-14307

The GeoTargetingWP WordPress plugin does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, creating a reflected cross-site scripting flaw (CWE-79). An unauthenticated attacker must craft a request containing malicious parameter values and trick a victim into submitting it, for example via a phishing link. When the victim triggers the request, the injected web script executes in the victim's browser in the context of the affected site, matching the CVSS impact of limited confidentiality, integrity and availability with a changed scope. Any WordPress installation running GeoTargetingWP before 3.5.6.2 is affected. No public proof of concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Update the GeoTargetingWP plugin to version 3.5.6.2 or later. If immediate updating is not possible, consider a WAF rule restricting or inspecting parameters passed to admin-ajax.php and caution site users against clicking unsolicited links that submit crafted requests. Check access logs for suspicious AJAX requests containing unexpected reflected parameters.