WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Security & Risk Analysis

wordpress.org/plugins/wpiko-chatbot

AI chatbot for WordPress with ChatGPT/OpenAI. WooCommerce, lead capture, and 24/7 support. Powered by Responses API. No monthly subscription.

30 active installs v2.0.0 PHP 7.0+ WP 6.0+ Updated Apr 7, 2026
chatbotchatgptlive-chatopenaiwoocommerce
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Safe to Use in 2026?

Generally Safe

Score 100/100

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 1mo ago
Risk Assessment

The wpiko-chatbot plugin v1.1.4 demonstrates a generally good security posture, with strong adherence to best practices such as extensive output escaping (99%) and a high percentage of SQL queries using prepared statements (79%). The plugin also has a clean vulnerability history, with no recorded CVEs, suggesting a history of secure development or diligent patching by users.

However, there are notable areas of concern. The presence of 2 AJAX handlers without authentication checks represents a significant attack surface. Additionally, the taint analysis revealed two flows with unsanitized paths, classified as high severity. These unsanitized paths, combined with the unprotected AJAX endpoints, could potentially lead to serious security vulnerabilities if exploited, despite the absence of direct SQL injection or cross-site scripting (XSS) in the identified taint flows. The plugin's relatively small attack surface and lack of complex bundled libraries are positive factors, but the identified unprotected entry points and taint issues require immediate attention.

Key Concerns

  • AJAX handlers without auth checks
  • High severity taint flows with unsanitized paths
Vulnerabilities
None known

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Release Timeline

v2.0.0Current
v1.1.4
v1.1.3
v1.1.2
v1.1.1
v1.1.0
v1.0.9
v1.0.8
v1.0.7
v1.0.6
v1.0.5
v1.0.4
v1.0.3
v1.0.2
v1.0.1
v1.0.0
Code Analysis
Analyzed Mar 16, 2026

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Code Analysis

Dangerous Functions
0
Raw SQL Queries
12
44 prepared
Unescaped Output
2
383 escaped
Nonce Checks
36
Capability Checks
20
File Operations
4
External Requests
16
Bundled Libraries
0

SQL Query Safety

79% prepared56 total queries

Output Escaping

99% escaped385 total outputs
Data Flows · Security
2 unsanitized

Data Flow Analysis

24 flows2 with unsanitized paths
wpiko_chatbot_ai_configuration_section (admin\sections\ai-configuration-section.php:6)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
2 unprotected

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Attack Surface

Entry Points25
Unprotected2

AJAX Handlers 24

authwp_ajax_wpiko_chatbot_load_file_managementadmin\admin-page.php:96
authwp_ajax_wpiko_chatbot_load_scan_websiteadmin\admin-page.php:109
authwp_ajax_wpiko_chatbot_load_qa_managementadmin\admin-page.php:122
authwp_ajax_wpiko_chatbot_load_woocommerce_integrationadmin\admin-page.php:135
authwp_ajax_wpiko_chatbot_validate_api_keyadmin\sections\api-key-section.php:107
authwp_ajax_wpiko_chatbot_fetch_conversationincludes\conversation-handler.php:387
authwp_ajax_wpiko_chatbot_delete_conversationincludes\conversation-handler.php:508
authwp_ajax_wpiko_chatbot_download_conversationincludes\conversation-handler.php:640
authwp_ajax_wpiko_chatbot_download_emailsincludes\conversation-handler.php:666
authwp_ajax_wpiko_chatbot_get_avatarincludes\conversation-handler.php:694
authwp_ajax_wpiko_chatbot_download_translated_conversationincludes\conversation-translation.php:210
authwp_ajax_wpiko_chatbot_list_filesincludes\files-list-handler.php:86
authwp_ajax_wpiko_chatbot_delete_fileincludes\files-list-handler.php:87
authwp_ajax_wpiko_chatbot_refresh_file_cacheincludes\files-list-handler.php:88
authwp_ajax_wpiko_chatbot_clear_debug_logsincludes\logging.php:177
authwp_ajax_wpiko_chatbot_toggle_debug_loggingincludes\logging.php:198
authwp_ajax_wpiko_chatbot_refresh_nonceincludes\nonce-refresh.php:67
noprivwp_ajax_wpiko_chatbot_refresh_nonceincludes\nonce-refresh.php:68
authwp_ajax_wpiko_chatbot_update_responses_configincludes\responses-api.php:583
authwp_ajax_wpiko_chatbot_upload_file_responsesincludes\responses-api.php:1202
authwp_ajax_wpiko_chatbot_delete_responses_vector_storeincludes\responses-api.php:1220
authwp_ajax_wpiko_chatbot_get_responses_vector_store_detailsincludes\responses-api.php:1238
authwp_ajax_wpiko_chatbot_send_messagewpiko-chatbot.php:222
noprivwp_ajax_wpiko_chatbot_send_messagewpiko-chatbot.php:223

Shortcodes 1

[wpiko_chatbot] wpiko-chatbot.php:134
WordPress Hooks 14
actionadmin_menuadmin\admin-page.php:34
actionadmin_enqueue_scriptsadmin\admin-page.php:83
actionwp_enqueue_scriptsadmin\sections\floating-chatbot-section.php:40
filterwpiko_chatbot_asset_versionincludes\cache-management.php:117
actionwp_headincludes\cache-management.php:120
actionwpiko_chatbot_assistant_updatedincludes\cache-management.php:123
actionadmin_noticesincludes\cache-management.php:126
actioninitincludes\cache-management.php:518
filteremoji_svg_urlincludes\conversation-handler.php:11
actionwp_footerincludes\floating-chatbot.php:185
actionwp_enqueue_scriptsincludes\sound-functions.php:23
actioninitwpiko-chatbot.php:44
actionwp_enqueue_scriptswpiko-chatbot.php:100
actionwp_enqueue_scriptswpiko-chatbot.php:289
Maintenance & Trust

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedApr 7, 2026
PHP min version7.0
Downloads1K

Community Trust

Rating100/100
Number of ratings1
Active installs30
Developer Profile

WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress Developer Profile

wpiko

1 plugin · 30 total installs

94
trust score
Avg Security Score
100/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/wpiko-chatbot/css/wpiko-chatbot.css/wp-content/plugins/wpiko-chatbot/css/frontend-transcript-styles.css/wp-content/plugins/wpiko-chatbot/js/wpiko-chatbot.js
Script Paths
/wp-content/plugins/wpiko-chatbot/js/wpiko-chatbot.js
Version Parameters
/wp-content/plugins/wpiko-chatbot/js/wpiko-chatbot.js?ver=/wp-content/plugins/wpiko-chatbot/css/wpiko-chatbot.css?ver=

HTML / DOM Fingerprints

CSS Classes
wpiko-chatbot-wrapperwpiko-chatbot-chatboxwpiko-chatbot-messageswpiko-chatbot-messagewpiko-chatbot-input-areawpiko-chatbot-inputwpiko-chatbot-send-buttonwpiko-chatbot-transcript-download
Data Attributes
data-wpiko-chatbot-urldata-wpiko-chatbot-floating-positiondata-wpiko-chatbot-api-typedata-wpiko-chatbot-responses-modeldata-wpiko-chatbot-api-keydata-wpiko-chatbot-placeholder-text+13 more
JS Globals
wpikoAjax
Shortcode Output
[wpiko_chatbot]
FAQ

Frequently Asked Questions about WPiko AI Chatbot – ChatGPT/OpenAI Assistant for WordPress