CVE-2026-61965
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The GeekyBot plugin versions up to 1.2.6 contain a Cross-Site Scripting (XSS) vulnerability that can be exploited without authentication.
Risk Assessment
An attacker can inject malicious scripts into pages viewed by other users, potentially leading to session theft or account takeover.
Recommendation
Update the GeekyBot plugin to the latest version that addresses this vulnerability.
Other vulnerabilities in GeekyBot
See all- CVE-2026-57679Critical
GeekyBot versions up to 1.2.5 are vulnerable to unauthenticated SQL injection. An attacker can remotely execute arbitrary SQL queries without authentication.
- CVE-2026-40772Critical
GeekyBot versions up to 1.2.2 have a vulnerability allowing unauthenticated arbitrary file uploads.
- CVE-2026-39519Critical
GeekyBot versions up to 1.2.0 are vulnerable to unauthenticated SQL injection, which may lead to unauthorized access to the database.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS