# Telegram Bot & Channel <= 4.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'telegram_m_send_content' Parameter

- **ID:** WPSEC-2026-1041
- **Plugin:** Telegram Bot & Channel (`telegram-bot`), https://wordpress.org/plugins/telegram-bot/
- **Affected versions:** all versions before 4.2.1
- **Fixed in:** 4.2.1 (Update to 4.2.1 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/telegram-bot
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1041/

## Description

The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram_m_send_content' parameter of the 'Send to Telegram' option in the post editor's publish box in all versions up to, and including, 4.2. This is due to insufficient input sanitization of the scheduled broadcast target and message stored in the 'telegram_future_publish' post meta when a post is scheduled, and missing output escaping when that value is printed back inside a textarea in the classic editor. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts that execute when another user, such as an administrator or editor, opens the scheduled post in the editor.

## References

- https://wpsec.com/vuln/WPSEC-2026-1041/
- https://plugins.svn.wordpress.org/telegram-bot/tags/4.2.1/
- https://wordpress.org/plugins/telegram-bot/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1041/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.