CVE-2026-15298: TelSender WordPress Plugin DOM XSS Vulnerability

Technical summary

CVE-2026-15298 is a DOM-based Cross-Site Scripting (XSS) vulnerability in TelSender WordPress plugin versions up to and including 1.14.14. The vulnerability arises from insufficient input sanitization of Telegram API responses, specifically in chat titles. When an administrator accesses the TelSender settings page and triggers the "Tested" button functionality, unsanitized chat title data is rendered directly in the DOM without proper escaping or validation. This allows an attacker to inject arbitrary JavaScript that executes in the administrative context. The attack vector is network-based, requires no authentication, and does not depend on complex conditions, resulting in a CVSS 3.1 score of 7.2 (HIGH severity). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Successful exploitation grants attackers the ability to execute arbitrary actions within WordPress administrator accounts. This includes stealing session cookies, modifying plugin settings, creating unauthorized admin accounts, injecting backdoors into site content, or pivoting to further compromise website infrastructure. For organizations using TelSender for Telegram integration workflows, this creates a direct path to site defacement, data exfiltration, and persistent infrastructure compromise. The attack surface is broad since any publicly known Telegram chat with a compromised title can be weaponized.

Affected systems

All WordPress installations running the TelSender plugin in versions up to and including 1.14.14 are affected. This includes both single-site and multisite WordPress deployments. Any WordPress admin who has activated TelSender and interacts with its settings page is vulnerable if an attacker has crafted a malicious Telegram chat title within a group or channel the plugin has accessed or can access.

Exploitability

This vulnerability is exploitable without authentication, from the network, and requires no special configuration or user interaction beyond what administrators routinely perform (opening settings and clicking the "Tested" button). An attacker needs only to compromise or create a Telegram chat with a malicious title and ensure the target plugin instance connects to or interacts with that chat. The low complexity and lack of privilege requirements make this highly exploitable in typical WordPress environments where administrators regularly manage plugin settings.

Remediation

Users of TelSender should update to a patched version released after 1.14.14. Verify against the official TelSender plugin repository or vendor advisory for the specific patched version. Organizations unable to update immediately should disable TelSender, restrict administrative access to plugin settings pages via IP allowlisting or WAF rules, and monitor for suspicious administrative actions. Ensure all administrators use strong, unique passwords and enable two-factor authentication on WordPress accounts.

Patch guidance

Update the TelSender plugin to the latest available version beyond 1.14.14 as indicated in the official WordPress plugin repository or vendor advisory. After patching, verify the update was successful by confirming the plugin version in the WordPress admin dashboard. Test the plugin's core functionality (particularly the "Tested" button in settings) to ensure the update did not introduce other issues. For multisite installations, ensure the patch is applied across all sites using the plugin.

Detection guidance

Monitor WordPress admin logs for unusual access to the TelSender settings page, particularly from unexpected geographic locations or IP addresses. Watch for JavaScript execution anomalies in browser developer console logs when administrators access the plugin settings. Implement Web Application Firewall (WAF) rules to detect and block script injection patterns in Telegram API response traffic. Check for injected scripts in the DOM of TelSender settings pages using browser security tools. Monitor for creation of unexpected administrator accounts or privilege escalations following admin access to the plugin settings. Enable WordPress security audit logging to track changes to plugin configurations.

Why prioritize this

This vulnerability merits immediate attention despite not being on the CISA KEV catalog because it requires no authentication, can be exploited remotely with low effort, and provides direct access to WordPress administrative functions. The combination of high CVSS score (7.2), broad impact on administrative accounts, and ease of exploitation creates urgent risk. Any WordPress site running TelSender is a potential compromise vector, and the attack can be triggered by routine administrative behavior. Organizations should treat this as a priority-one remediation item.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), requirement for no privileges (PR:N), and no user interaction needed (UI:N), combined with scope changes (S:C) that allow impact on resources beyond the vulnerable component. While the confidentiality and integrity impacts are rated as low (C:L/I:L) and availability is not affected (A:N), the convergence of accessibility, exploitability, and privilege escalation potential in a WordPress administrative context elevates practical risk beyond the numeric score alone.

Frequently asked questions