GeoTargetingWP Plugin CVE-2026-14307

Exploitation requires the geotargetingwp plugin to be installed and active on a WordPress site (version < 3.5.6.2). No authentication is needed from the attacker side (PR:N per CVSS). However, UI:R is a firm constraint: a victim must be socially engineered into submitting a crafted HTTP request - this cannot be triggered passively by visiting a page. The impact is most severe when the victim is an authenticated WordPress administrator, as their session token can be captured or their privileges abused. Against non-administrative visitors, the impact is limited to that individual's browser session. There is no evidence this is exploitable against default WordPress configurations without the specific plugin installed.

The CVSS 3.1 score of 7.1 is anchored by S:C (Scope Changed), which is appropriate for XSS - the impact crosses from the WordPress application boundary into the victim's browser context. PR:N confirms unauthenticated exploitation is possible, and AC:L indicates no special conditions beyond getting the victim to submit the request. The A:L metric in the provided vector is atypical for reflected XSS; availability impact is not substantiated by the description and appears overstated. EPSS at 0.17% (7th percentile) suggests very low observed exploitation in practice. However, the existence of a public POC (WPScan) materially elevates the operational risk over EPSS alone, as opportunistic actors can weaponize it without custom development. The vulnerability is not in CISA KEV, so confirmed active exploitation is not established. The realistic risk is highest when targeting authenticated admin users, where script execution could result in site takeover; against unauthenticated visitors, impact is more limited.

An attacker crafts a URL or form submission targeting the geotargetingwp AJAX endpoint, embedding a JavaScript payload (e.g., a cookie-stealing script) in one of the unsanitized parameters. The attacker then delivers this URL to a logged-in WordPress administrator via phishing or a malicious link. When the admin submits the request, the AJAX response reflects the script back in an HTML-typed response, executing it in the admin's browser session - potentially enabling the attacker to hijack the session or perform privileged actions on the WordPress site. A public POC is available through WPScan, lowering the skill barrier for exploitation.