EUVD-2026-68155
GHSA-xg5h-jcfm-24g6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS with scope change; no availability impact substantiated; all other metrics align with unauthenticated, user-interaction-required, network-delivered XSS.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.
AnalysisAI
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the geotargetingwp plugin to be installed and active on a WordPress site (version < 3.5.6.2). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 is anchored by S:C (Scope Changed), which is appropriate for XSS - the impact crosses from the WordPress application boundary into the victim's browser context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the geotargetingwp plugin to version 3.5.6.2 or later, which introduces proper sanitization and escaping of parameters in AJAX responses and corrects the HTML content-type issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running geotargetingwp and confirm which are running versions before 3.5.6.2; flag any managed by administrative users as priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today