A critical reflected cross-site scripting vulnerability in the GeotargetingWP plugin allows unauthenticated attackers to execute malicious scripts in the context of a victim's browser.

The plugin suffers from improper neutralization of input during web page generation (CWE-79), specifically failing to sanitize AJAX parameters before reflecting them in responses. This vulnerability allows an unauthenticated attacker to inject arbitrary scripts that execute when a victim interacts with a crafted request.

Successful exploitation allows attackers to execute unauthorized JavaScript in the user's session, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive data. With a CVSS score of 7.1, this vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment, particularly if administrative users are targeted.

Immediate Action: Update the GeotargetingWP plugin to version 3.5.6.2 or later immediately to apply the necessary sanitization patches.

Proactive Monitoring: Review web server access logs for suspicious AJAX requests containing script tags or abnormal character encodings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to identify and block malicious payloads targeting WordPress plugin endpoints.

Public Exploit Available: Unknown

Given the ease with which unauthenticated attackers can leverage reflected cross-site scripting to compromise user sessions, immediate remediation is required. Organizations utilizing the GeotargetingWP plugin must prioritize the update to version 3.5.6.2 to eliminate this attack vector and protect administrative and user accounts from potential script injection.