CVE-2025-15266 is a stored Cross-Site Scripting vulnerability in the GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation WordPress plugin. The vulnerability exists due to improper neutralization of input in the chat message field, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when an administrator accesses the Chat History page, potentially leading to credential theft or session hijacking. The vulnerability affects all versions up to and including 1.1.8. There is no vendor-provided patch or official fix available at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the administrator's browser session when viewing the Chat History page. This can result in theft of administrative credentials, session tokens, or other sensitive information accessible to the administrator. The vulnerability does not impact availability but compromises confidentiality and integrity of the administrator's session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should restrict access to the Chat History page to trusted users only and consider disabling or removing the plugin if feasible. Monitoring for suspicious activity related to administrator sessions is advised. Avoid interacting with untrusted chat messages within the plugin interface.