CVE-2026-14307: CWE-79 Cross-Site Scripting (XSS) in geotargetingwp

CVE-2026-14307 is a CWE-79 Cross-Site Scripting vulnerability in the geotargetingwp WordPress plugin versions prior to 3.5.6.2. The flaw arises from insufficient sanitization and escaping of multiple parameters in AJAX responses, which are returned with an HTML content type. This allows unauthenticated attackers to inject malicious scripts that execute when a victim interacts with a crafted request, potentially leading to cross-site scripting attacks.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, which may result in information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 (high) reflects the network attack vector, low attack complexity, no privileges required, but requires user interaction and impacts confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid interacting with untrusted links or inputs that could trigger the vulnerability. Monitor the vendor's announcements for updates and apply any released patches promptly.