VulnSocial

CVE-2026-14307Disclosure

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-28: 1Technical Details · 2026-08-28: 108-28
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Andrew Gömez@red_darkin
    Disclosure

    My first CVE: CVE-2026-14307 Found a reflected XSS in the Geotargeting WP WordPress plugin (< 3.5.6.2). Several parameters are reflected unsanitized in AJAX responses served as HTML > an unauthenticated attacker can inject scripts via a crafted request. https://wpscan.com/vulnerability/5f55b592-9113-47d1-8b48-6ba785c0834a/ https://t.co/1UXzzfLQkP

    Post summary

    Disclosed a reflected XSS vulnerability (CVE‑2026‑14307) in the Geotargeting WP plugin affecting versions older than 3.5.6.2, with no exploitation, patch, or PoC details provided.

    11072547
    575 followersView on X

Explore more

Back to dashboard