CVE-2026-15298

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator opens the TelSender settings page and clicks the "Tested" button.

• CWE-79

• https://plugins.trac.wordpress.org/browser/telsender/tags/1.14.14/js/ajax.js#L119
• https://plugins.trac.wordpress.org/browser/telsender/tags/1.14.14/js/ajax.js#L139
• https://plugins.trac.wordpress.org/browser/telsender/tags/1.14.14/template/view.php#L111
• https://plugins.trac.wordpress.org/browser/telsender/trunk/js/ajax.js#L119
• https://plugins.trac.wordpress.org/browser/telsender/trunk/js/ajax.js#L139
• https://plugins.trac.wordpress.org/browser/telsender/trunk/template/view.php#L111
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449367%40telsender&new=3449367%40telsender&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cb02878a-2c85-4dcb-bdc0-e65addf9fb9c?source=cve

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15291The Chat Help – Click to Chat Button & Form plugin for WordP…7.5
• CVE-2026-15292The Sudoku Shortcode plugin for WordPress is vulnerable to S…6.4
• CVE-2026-15293The WP Business Intelligence Lite plugin for WordPress is vu…8
• CVE-2026-15295The WordPress Infinite Scroll – Ajax Load More plugin for Wo…4.4
• CVE-2026-15296The affiliate-toolkit – WP Affiliate Plugin with Amazon plug…6.4
• CVE-2026-15297The Newsletter, SMTP, Email marketing and Subscribe forms by…6.1
• CVE-2026-15299The Animation Addons for Elementor plugin for WordPress is v…6.4
• CVE-2026-1530A flaw was found in fog-kubevirt. This vulnerability allows …8.1
• CVE-2026-15300The GEO my WP plugin for WordPress was vulnerable to SQL Inj…9.1
• CVE-2026-15301The BuddyHolis TableSearch plugin for WordPress is vulnerabl…6.4
• CVE-2026-15302The ARMember plugin for WordPress is vulnerable to Directory…5.3
• CVE-2026-15304The Plugin Organizer plugin for WordPress is vulnerable to S…6.5