PT-2026-2822 · WordPress · Geekybot — Generate Ai Content Without Prompt

D.Sim · Publicado 2026-01-14 · Atualizado 2026-01-19 · CVE-2025-15266

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress versions through 1.1.7

Description The software is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the chat message field. This allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when an administrator accesses the Chat History page.

Recommendations Update GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress to a version later than 1.1.7.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-15266

Produtos afetados

Geekybot — Generate Ai Content Without Prompt

Referências · 8

• https://twitter.com/VulmonFeeds/status/2011418656438153364 · Publicação no Twitter
• https://wordpress.org/plugins/geeky-bot · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440963%40geeky-bot&new=3440963%40geeky-bot&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b30e84db-c73f-4df2-9c88-c37a7e14c95b?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15266 · Nota de Segurança
• https://twitter.com/cracbot/status/2013204857793159318 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2011600165170192675 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2011382987011641838 · Publicação no Twitter