CVE-2026-15298Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator opens the TelSender settings page and clicks the "Tested" button.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-15298/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters92d
Disclosure
#CVE-2026-15298 - #DOM-Based #XSS in Telsender #WordPress plugin up to 1.14.14. Unauthenticated attackers can #inject scripts via Telegram chat titles, executing when admin clicks "Tested". #CVSS 7.2. Disable plugin until fixe #devsecops #devops #sysadmin #developers https://www.valtersit.com/cve/CVE-2026-15298/
Post summary
The post discloses a DOM‑based XSS flaw (CVE‑2026‑15298) in the Telsender WordPress plugin, detailing the input vector via Telegram chat titles, affected versions, and advises disabling the plugin until a patch is available.
0000076
975 followersView on X

Explore more

Back to dashboard