WP Manifestindependent plugin directory
manifest / ai / website-ai-assistant

Website AI Assistant WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

AI Website Chatbot WordPress Plugin

★ 0stars
5release downloads
v4.1.0latest · 3mo ago

Install

Download website-ai-assistant.zip From the v4.1.0 release on GitHub, Jun 26, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bcardi0427/website-ai-assistant/releases/download/v4.1.0/website-ai-assistant.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Plugin Name: Website AI Assistant
Plugin URI: https://github.com/bcardi0427/website-ai-assistant/
Description: An AI-powered chat assistant for WordPress websites using Google's Gemini API
Version: 3.0.0 Author: Gerald Haygood
Author URI: https://github.com/bcardi0427/website-ai-assistant/
License: GPL v2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Text Domain: website-ai-assistant
Domain Path: /languages

Features

  • Multi-provider AI integration:
    • Google Gemini AI (with models like Gemini 2.0, 1.5 Flash, 1.5 Pro)
    • OpenAI (with dynamic model selection)
    • Deepseek (with configurable models and endpoint)
  • Website-specific knowledge base
  • Advanced lead generation and management:
    • Configurable form timing (immediate, after first message, after two messages, or at end)
    • Customizable form heading and description
    • Skip option for users
    • FluentCRM integration for automated lead management
  • Customizable system prompts
  • Search integration (Google Custom Search & Algolia)
  • Privacy-focused design

Installation

  1. Download the plugin zip file
  2. Go to WordPress Admin → Plugins → Add New → Upload Plugin
  3. Activate the plugin through the 'Plugins' menu in WordPress
  4. Configure your API keys in the plugin settings

Configuration

Required API Keys

The plugin supports multiple AI providers. You'll need at least one of these API keys:

  1. Gemini API Key - Get from Google AI Studio (default provider)
  2. OpenAI API Key - Get from OpenAI dashboard
  3. Deepseek API Key - Get from Deepseek platform

For search functionality (optional):

  1. Google Search API Key - For Google Custom Search integration
  2. Algolia API Keys - For Algolia search integration (requires app ID, search key, and admin key)

Settings

  • System message customization
  • Lead Generation Configuration:
    • Enable/disable lead collection
    • Form timing options (immediate, after first message, after two messages, or end)
    • Customizable form heading and description
    • FluentCRM integration settings:
      • List selection
      • Tag assignment
      • Contact status configuration
  • Display settings
  • Privacy policy configuration
  • Debug mode

Usage

  1. Configure your API keys in the plugin settings
  2. Customize the chat interface appearance
  3. Set up your system message and prompts
  4. Configure lead collection settings
  5. Add the chat widget to your website

Security

  • All API keys are stored securely in WordPress options
  • Nonce verification for all AJAX requests
  • Input/output sanitization
  • HTTPS enforced for all API communication
  • Debug mode controlled through settings

Contributing

We welcome contributions! Please follow these guidelines:

  1. Fork the repository
  2. Create a feature branch
  3. Submit a pull request
  4. Follow WordPress coding standards

License

This project is licensed under the GPL v2 License - see the LICENSE file for details.

Support

For support, please open an issue on GitHub or contact the maintainers.

Changelog

3.0.0

  • Added multiple AI provider support:
    • Google Gemini AI integration:
      • Support for Gemini 2.0 Flash Experimental
      • Support for Gemini 1.5 Flash and Flash 8B
      • Support for Gemini 1.5 Pro and 1.0 Pro
    • OpenAI integration:
      • Dynamic model selection
      • Model caching with refresh option
      • Improved API key management
    • Deepseek integration:
      • Configurable API endpoint
      • Dynamic model loading
      • Enhanced error handling
  • Enhanced lead generation functionality:
    • Added configurable form timing options (immediate, after first message, after two messages, or end)
    • Implemented dynamic FluentCRM integration with list and tag selection
    • Added customizable form heading and description
    • Added skip option for users who don't want to provide contact info
    • Improved form display controls and validation
  • Improved FluentCRM integration:
    • Dynamic loading of lists and tags
    • Better error handling and validation
    • Enhanced admin UI for FluentCRM settings
  • Improved search capabilities:
    • Added Algolia integration
    • Enhanced Google Custom Search support
  • Added comprehensive settings sanitization
  • Updated documentation with detailed provider and lead generation configuration

2.2.5

  • Added enhanced security measures
  • Improved error handling
  • Updated documentation

2.2.0

  • Initial public release

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v4.1.0 latest
Jun 26, 2026 3mo ago
website-ai-assistant.zip
3
Jun 26, 2026 3mo ago
website-ai-assistant.zip
1
Jan 31, 2025 1 year ago
website-ai-assistant.zip
1
D+ grade

Security

Website AI Assistant 4.1.0 · audited by WP Registry

High-severity findings.

2 high
Audited release
4.1.0
Findings
2
Worst severity
high
Content hash
dfd03737484319a031890b26…

Findings

  • high Debug logger writes full AI settings including API keys

    information_disclosure

    When enable_debug is on, handle_chat_message logs 'all_settings' => $options (containing gemini/openai/deepseek/google API keys) via Debug_Logger to WP_CONTENT_DIR/debug.log. Anyone who can read that file (misconfigured web root, shared hosting, backups) obtains live secrets. Unauthenticated chat AJAX can trigger the log line once debug is enabled.

    includes/class-chat-handler.php:224-232

    Recommendation

    Never log secrets; redact *_api_key fields; prefer WP_DEBUG_LOG outside the web root.

  • high Direct-access test script bootstraps WordPress via wp-load.php

    unnecessary_attack_surface

    test/algolia-test.php requires ../../../../wp-load.php when ABSPATH is undefined, then runs an Algolia search and echoes completion. If the plugins directory is web-accessible (common), unauthenticated visitors can hit this endpoint, bootstrap WP, and exercise the Algolia integration / leak errors.

    test/algolia-test.php:1-18

    Recommendation

    Remove test/ from production builds or guard with current_user_can( 'manage_options' ) and ABSPATH-only inclusion (no wp-load bootstrap).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.