Geotargetingwp
Monthly
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.