What is the CVSS score of CVE-2026-61965?

CVE-2026-61965 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of GeekyBot are affected by CVE-2026-61965?

The GeekyBot WordPress plugin (versions 1.2.6 and below) contains an unauthenticated cross-site scripting vulnerability that could allow attackers to inject malicious code into any website running…

How to fix or mitigate CVE-2026-61965?

Within 24 hours, inventory all WordPress installations to identify those running GeekyBot versions 1.2.6 or below and immediately disable or uninstall the plugin from affected systems. Within 7 days, review access logs for indicators of exploitation (unusual JavaScript execution, unexpected redirects, unauthorized admin account activity), enable monitoring for any vendor security updates, and implement Content Security Policy headers to restrict script execution. Within 30 days, evaluate alternative WordPress plugins to replace GeekyBot functionality, establish a formal plugin management policy requiring regular security patches, deploy Web Application Firewall rules to detect XSS payloads, and conduct administrator training on third-party plugin security risks.

GeekyBot CVE-2026-61965

EUVD-2026-57970 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-34cq-fq34-3j6j

WordPress XSS Wordpress Plugin Geekybot Ahmadgb

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-accessible, no auth, low complexity XSS with scope change into victim's browser; UI:R because victim must load the injected page; all impacts Low.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:48 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

AnalysisAI

Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who visits an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity network exploitation requiring no credentials, with the scope change indicating the injected script crosses into the victim's browser security context. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

GeekyBot is a WordPress chatbot plugin authored by ahmadgb (CPE: cpe:2.3:a:ahmadgb:geekybot:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), meaning the plugin fails to adequately sanitize or escape user-supplied input before rendering it in the browser. The CVSS scope change (S:C) is characteristic of XSS: while the injection point resides in the WordPress plugin, the executed payload operates within the victim's browser session, crossing the trust boundary between the web application and the end user's security context. Whether this is stored or reflected XSS is not confirmed in available data, though both subtypes are consistent with the reported attack vector and the Patchstack reporting context.

RemediationAI

Update GeekyBot to a version beyond 1.2.6 as soon as one becomes available; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geeky-bot/vulnerability/wordpress-geekybot-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve to confirm the exact patched release number, which is not independently verified from available data. If no patched version is yet available, the most effective compensating control is deactivating and removing the plugin, eliminating the attack surface entirely at the cost of losing chatbot functionality. Alternatively, deploying a WAF with rules targeting script-injection patterns in GeekyBot-related request parameters can reduce exploitation probability, though WAF rules can be bypassed by encoding variations and should not be treated as a permanent fix. Restrict access to pages that render GeekyBot output to authenticated users only where the use case permits, reducing exposure to unauthenticated attackers.