GeekyBot CVE-2026-61965

No authentication is required (PR:N confirmed by CVSS vector). Exploitation requires that a victim user actively load or visit a page where GeekyBot renders unsanitized output (UI:R); without this interaction the payload does not execute. The target WordPress site must have GeekyBot version 1.2.6 or earlier installed and active. The specific GeekyBot input parameter or feature responsible for the unsanitized output is not identified in available data. No non-default configuration is indicated as a prerequisite. The primary limiting factor for impact is the requirement for victim interaction - passive server-side exploitation is not possible under this attack class.

The CVSS 7.1 score with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a moderate-to-high-rated finding: network-accessible, no authentication required, and low attack complexity, but dependent on victim interaction (UI:R). The scope change elevates the base score, but all three impact dimensions are rated Low, indicating the per-exploitation blast radius is limited - typically session cookie theft, credential harvesting, or page defacement rather than server compromise. EPSS data is absent from available intelligence, making probabilistic exploitation forecasting impossible. No KEV listing and no POC reference mean confirmed or widespread active exploitation is not established. For WordPress deployments, unauthenticated XSS in plugins carries meaningful realistic risk because plugin pages are visited by authenticated administrators and editors routinely, making session hijacking a credible outcome. However, the low individual-event impact and niche plugin footprint temper overall organizational priority compared to unauthenticated RCE or SQL injection class issues.

An unauthenticated attacker submits a crafted input containing a JavaScript payload - such as a cookie-stealing script - through a GeekyBot-exposed parameter on the target WordPress site. When an authenticated administrator or editor visits the affected page (e.g., via a phishing link or a poisoned search result), the payload executes in their browser, exfiltrating their session token to an attacker-controlled server. No public exploit code has been identified, but the AC:L and PR:N ratings indicate the attack requires no specialized tooling or credentials.