CVE-2026-93514: WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Notification for Telegram Pluginto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
What plugin versions are affected?
Notification for Telegram versions 3.5.2 and earlier are identified as affected. The provided data does not identify a fixed version.
What impact could successful exploitation have?
Successful XSS could affect confidentiality, integrity, and availability at low impact according to the CVSS vector. Its scope is changed, meaning the impact may extend beyond the vulnerable component.