Ahmadgb vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Ahmadgb products: 5 record(s), with severity, exploitation and fixes.

GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content 2 GeekyBot 2 GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation 1

Exploited only (KEV) →

CVE-2026-61965 High · 7.1 CWE-79 Aug 13, 2026

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

CVE-2026-57679 Critical · 9.3 CWE-89 Jul 2, 2026

WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

CVE-2026-5294 Critical · 9.8 CWE-862 May 5, 2026

GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action

The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlled model/function dispatch and reaching a plugin installer helper that downloads and unzips attacker-supplied ZIP files into wp-content/plugins/. This makes it possible for unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution.

CVE-2026-3456 High · 7.5 CWE-89 May 5, 2026

GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'

The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2025-15266 High · 7.2 CWE-79 Jan 14, 2026

GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting

The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat message field in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the Chat History page.