Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce has 8 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 8 are fixed as of October 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 6 high. 2026 was the busiest year with 8 disclosures.
The most common weakness is SQL Injection, behind 3 of the records (38%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 8 issues recorded for Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce has a vendor fix available, so running the current release closes all known holes.
7 independent researchers contributed these findings, most of them (2) reported by Nguyen Ba Khanh. Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-5294GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action
Read the full analysisVulnerability Records

Geeky Bot – AI Chatbot & Sales Assistant for WooCommerce
Author
GeekyBot
Geeky Bot turns a WooCommerce store into a guided shopping experience. A shopper can ask “Show me wireless headphones under $100 that are in stock,” follow with “Which would you recommend for daily commuting?” and then ask “Does the recommended pair support noise cancellation?” Geeky Bot searches visible products, remembers context, explains suitable matches, and answers from WooCommerce data and approved policy pages. It is built as a focused sales assistant—not a generic website chatbot. See Geeky Bot in action Watch Geeky Bot turn natural shopper questions into product discovery, comparisons, grounded answers, and buying assistance inside WooCommerce. Natural WooCommerce product discovery Help shoppers discover products by: Product name, family, category, price, color, size, stock, and sale status. Use case, shopper preference, and natural long-form requests. Follow-up refinements, synonyms, spelling mistakes, and close matches. Search results remain grounded in products that are visible in the WooCommerce catalog. Product answers shoppers can trust Geeky Bot answers from available WooCommerce descriptions, attributes, variations, prices, and stock. When information is missing, the assistant says so instead of inventing details. Helpful recommendations Geeky Bot can recommend suitable products and explain why they match the shopper’s request. If no exact result exists, it can present clearly labeled close matches or suggest a sensible constraint to remove. Store policy answers Choose which published pages Geeky Bot may use for shipping, refunds, returns, exchanges, warranty, payment, privacy, and other store-policy questions. Policy answers stay isolated to approved sources. Geeky Bot does not crawl arbitrary pages. Storefront shopping assistant The responsive floating widget provides product cards, suggested questions, a configurable timed shopper invitation, clear shopper and assistant message identity, persistent browser-side history, clear-chat control, accessible focus states, reduced-motion support, and scoped styling designed to avoid theme conflicts. A practical setup experience The guided setup checks WooCommerce, builds the product index, selects policy pages, configures the widget, and verifies readiness. Guided Demo creates realistic test questions from the store’s own products, including short conversations that show a follow-up question being answered in context. Conversations, insights, and privacy Store owners can review conversations, group unanswered questions, see products opened from chat, export data to CSV, delete stored conversations, configure guest storage and retention, and use WordPress personal-data export and erasure tools. Local mode and optional AI services Core discovery and grounded routing can run locally. Zywrap and OpenAI are optional. API keys are not exposed to storefront JavaScript or displayed again after saving. Geeky Bot Commerce Pro The free plugin helps shoppers find and understand products. Geeky Bot Commerce Pro adds variation selection, cart and checkout actions, order help, product comparison, advanced recommendations, and sales-intent analytics. Learn more at geekybot.com. Privacy Depending on the settings chosen by the store owner, Geeky Bot may store conversation messages, session identifiers, response intent, product references, policy references, and product-click events in the WordPress database. The plugin provides retention settings, conversation deletion tools, and integration with the WordPress personal-data export and erasure system. Store owners are responsible for describing their configuration and data practices in their own privacy policy. Shopper questions are sent to an external AI provider only when the administrator has selected and configured that provider. With the Rescue search level or learning from missed searches switched on, the wording of searches that found nothing is also sent to that provider, as described under External services. External services Geeky Bot can operate in local grounded mode without sending shopper questions to an external AI provider. External requests occur only for optional services selected or used by an administrator. OpenAI When OpenAI mode is selected and an API key is saved, Geeky Bot sends the shopper’s question, a grounding instruction, relevant visible-product summaries, and relevant excerpts from approved policy pages to the OpenAI API to generate the requested answer. The product search levels also use the OpenAI API with the saved key. Each is off until the administrator selects it under Geeky Bot → Product Search, and the Standard level makes no external requests. Smart Catalog: for each visible product, Geeky Bot sends the product title, categories, tags, attributes and a short summary of up to 240 characters taken from the product description, and asks for the words shoppers use for that product. It is sent when Smart Catalog is switched on, when a product is added or changed, and when the administrator asks for words to be rewritten. No shopper data is sent. Rescue (requires Commerce Pro): when a shopper’s search finds nothing, Geeky Bot sends the wording of that search and a list of the store’s category and product-type words, and asks which of those words fit. Each answer is stored for 30 days and reused, so the same search is not sent again during that time. Learning from missed searches (requires Commerce Pro, and the Smart Catalog or Rescue level): once a day, Geeky Bot sends the text of recent shopper messages that found no products, with the same list of store words, and asks for synonym suggestions. Suggestions are shown to the administrator and only used after they are accepted. A site-wide daily and monthly limit on AI calls applies to all of these, and can be set under Geeky Bot → AI & Privacy. Service: https://api.openai.com/ Terms: https://openai.com/policies/terms-of-use/ Privacy: https://openai.com/policies/privacy-policy/ Zywrap When Zywrap mode is selected, Geeky Bot sends the shopper’s question, a grounding instruction, relevant visible-product context, and relevant approved policy-page context to the configured Zywrap HTTPS endpoint to generate the requested answer. No shopper question is sent to Zywrap when local mode is selected. Service: https://www.zywrap.com/ Terms: https://www.zywrap.com/terms Privacy: https://www.zywrap.com/privacy Geeky Bot website When an administrator chooses to view information about Commerce Pro or follow support, documentation, purchase, account, or upgrade links, the browser connects to geekybot.com. Translations. Geeky Bot does not ship its translations; it downloads the one for your site’s language from geekybot.com, the way WordPress installs its own language packs. This happens only on a site that is not in English (or whose users have chosen another language): when Geeky Bot is installed or updated, when the site language changes, and once a day to pick up improved translations. The request reads a public list (https://geekybot.com/translations/v2/index.json) and downloads a .zip holding a .po and a .mo file, checked against the SHA-256 the list gives. Nothing about the site is sent: no address, no key, no content, and the user-agent names only Geeky Bot and its version. Turn it off with define(‘GEEKYBOT_TRANSLATIONS_AUTO’, false); in wp-config.php; the files can then be downloaded from Geeky Bot > Languages and installed by hand. Commerce Pro license. The free plugin sends nothing else to geekybot.com until an administrator enters a Commerce Pro license key under Geeky Bot > License. After that: To activate the license, and to re-check it about once a week, Geeky Bot sends the key to geekybot.com with the site address, the WordPress, PHP and Geeky Bot versions, the site language and whether the site is a multisite. geekybot.com answers with a signed statement of what the license covers. When the administrator installs or updates Commerce Pro, Geeky Bot asks geekybot.com for a one-time download link and downloads the add-on from geekybot.com. While Commerce Pro is installed, Geeky Bot asks geekybot.com twice a day whether a newer Commerce Pro exists, sending the key, the site address and the installed Geeky Bot and Commerce Pro versions. Deactivating the license on the License page tells geekybot.com to free this site’s slot and deletes the key from the site. Service: https://geekybot.com/ Terms: https://geekybot.com/terms-conditions/ Privacy: https://geekybot.com/privacy-policy/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C