Executive brief
The Geotargeting WP WordPress plugin is used to serve location-based content to website visitors. The plugin fails to properly sanitize user input in AJAX requests, allowing attackers to inject malicious scripts that execute in victims' browsers when they click a specially crafted link, potentially leading to account theft, malware distribution, or defacement.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the Geotargeting WP WordPress plugin before version 3.5.6.2. The vulnerable component does not sanitize or escape several parameters before reflecting them back in AJAX responses served with an HTML content type (CWE-79). The attack requires no authentication and is delivered via the network; however, it requires user interaction—a victim must be tricked into submitting a crafted request (e.g., clicking a malicious link). Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser context. The vulnerability is fixed in version 3.5.6.2.
Affected products
- Geotargeting WP Geotargeting WP before 3.5.6.2
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Fixed in version 3.5.6.2