GeekyBot

GeekyBot is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 1.2.6.

Geeky Bot before 1.2.8 exposes its chat-history pagination through the public geekybot_ajax AJAX dispatcher without an authorization check. An unauthenticated visitor can POST action=geekybot_ajax, geekybotme=chathistory, task=getNextChatHistorySessions and an offset value to enumerate ten sessions per page. The response discloses WordPress display names, user IDs and chat timestamps; the published.

GeekyBot is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.2.5.

GeekyBot is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is n/a through 1.2.2.

GeekyBot is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.2.0.

GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 1.2.2.

GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.