CVE-2026-14307— Geotargeting WP < 3.5.6.2 - Reflected XSS
Quick assessment
Affected
Unknown geotargetingwp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
geotargetingwp WordPress 插件在 3.5.6.2 版本之前，未对 AJAX 响应中反射的多个参数进行清洗或转义，且这些响应以 HTML 内容类型返回。这使得未认证的攻击者能够注入任意的 Web 脚本，当受害者被诱骗提交特制的请求时，这些脚本将会被执行。
Possible ATT&CK Techniques 3 AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14307
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Geotargeting WP < 3.5.6.2 - Reflected XSS
Source: CVE Program / CVE List V5
Vulnerability Description
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | geotargetingwp | 0 ~ 3.5.6.2 | - |
|
II. Public POCs for CVE-2026-14307
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14307
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14307 (1)
-
🔗 Geotargeting WP < 3.5.6.2 – Reflected XSS | CVE 2026-14307 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-30 · 7 CVEs total
| CVE-2026-81660 | Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field | |
| CVE-2026-81766 | Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation vi | |
| CVE-2026-78364 | MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List | |
| CVE-2026-19722 | WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup | |
| CVE-2026-76585 | Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Para | |
| CVE-2026-14835 | SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Pos |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-81660
Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web For -
CVE-2026-81766
Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Ar -
CVE-2026-78364
MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data Lis -
CVE-2026-19722
WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File -
CVE-2026-76585
Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated
V. Comments for CVE-2026-14307
No comments yet