CVE-2026-14307

7.1 Élevée

Publiée le 30/08/2026 à 09:17 · Modifiée le 31/08/2026 à 22:14 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

Traduire en français

Produits concernés

Unknown geotargetingwp

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/5f55b592-9113-47d1-8b48-6ba785c0834a/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories