THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-14307 — The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim

[NVD] CVE-2026-14307 — The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim

mednvdPublished 2026-08-30

CVE-2026-14307 CVSS: None Published: 2026-08-30T07:17:20.000

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

Indicators of compromise

CVE-2026-14307cve
3.5.6.2ipv4

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-14307