PT-2026-2822 · WordPress · Geekybot — Generate Ai Content Without Prompt

D.Sim · Published 2026-01-14 · Updated 2026-01-19 · CVE-2025-15266

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress versions through 1.1.7

Description The software is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the chat message field. This allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute when an administrator accesses the Chat History page.

Recommendations Update GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress to a version later than 1.1.7.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15266

Affected Products

Geekybot — Generate Ai Content Without Prompt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-15266 · Security Note
• https://twitter.com/VulmonFeeds/status/2011418656438153364 · Twitter Post
• https://wordpress.org/plugins/geeky-bot · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440963%40geeky-bot&new=3440963%40geeky-bot&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b30e84db-c73f-4df2-9c88-c37a7e14c95b?source=cve · Note
• https://twitter.com/cracbot/status/2013204857793159318 · Twitter Post
• https://twitter.com/RedPacketSec/status/2011600165170192675 · Twitter Post
• https://twitter.com/CVEnew/status/2011382987011641838 · Twitter Post