Telegram Bot & Channel <= 4.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'telegram_m_send_content' Parameter
- ID
- WPSEC-2026-1041
- Plugin
- Telegram Bot & Channel (telegram-bot)
- Affected
- all versions before 4.2.1
- Remediation
- Update to 4.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- Telegram Bot & Channel on WPSec AttackSurface
- Fix released
- Published
Description
The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram_m_send_content' parameter of the 'Send to Telegram' option in the post editor's publish box in all versions up to, and including, 4.2. This is due to insufficient input sanitization of the scheduled broadcast target and message stored in the 'telegram_future_publish' post meta when a post is scheduled, and missing output escaping when that value is printed back inside a textarea in the classic editor. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts that execute when another user, such as an administrator or editor, opens the scheduled post in the editor.
References
- https://wpsec.com/vuln/WPSEC-2026-1041/
- https://plugins.svn.wordpress.org/telegram-bot/tags/4.2.1/
- https://wordpress.org/plugins/telegram-bot/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS