What is the CVSS score of CVE-2026-15298?

CVE-2026-15298 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of TelSender are affected by CVE-2026-15298?

TelSender WordPress plugin (versions through 1.14.14) contains a cross-site scripting vulnerability enabling unauthenticated attackers to compromise administrator accounts through a maliciously…

How to fix or mitigate CVE-2026-15298?

Within 24 hours: Identify all WordPress installations running TelSender plugin and immediately disable it as a temporary measure to block exploitation. Within 7 days: Check vendor advisories for patch availability; if patch released, apply to all instances; if not, either keep plugin disabled or migrate to alternative functionality. Within 30 days: Confirm remediation across all systems and conduct password reset for any administrator accounts that accessed the vulnerable plugin during the exposure period.

TelSender CVE-2026-15298

EUVD-2026-42805 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 security@wordfence.com

GHSA-fxxv-579v-962v

WordPress XSS

7.2

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated injection (PR:N) but the payload only fires when an admin opens settings and clicks 'Tested', so UI:R; DOM XSS runs in the admin context giving S:C with limited C:L/I:L and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 05:37 vuln.today

CVE Published

Jul 10, 2026 - 05:16 nvd

HIGH 7.2

DescriptionCVE.org

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator opens the TelSender settings page and clicks the "Tested" button.

AnalysisAI

DOM-based cross-site scripting in the TelSender WordPress plugin (all versions through 1.14.14) lets unauthenticated attackers plant a malicious payload inside a Telegram chat title that the plugin renders unsanitized. When an administrator opens the TelSender settings page and clicks the 'Tested' button, the plugin processes the attacker-controlled Telegram API response and executes the injected script in the admin's authenticated browser session. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the scope-changed CVSS 7.2 reflects execution in the privileged admin context.

Technical ContextAI

The root cause is CWE-79 (improper neutralization of input during web page generation), specifically the DOM-based variant where client-side JavaScript writes untrusted data into the page without encoding. The vulnerable logic sits in the plugin's AJAX handler and settings template: js/ajax.js (around lines 119 and 139) consumes JSON returned from the Telegram Bot API, and template/view.php (line 111) surfaces it. Because a Telegram chat's title is fully controlled by whoever creates or renames that chat, an attacker who can get the site's bot into a chat they control supplies the payload; the plugin injects that title into the DOM as markup rather than text, so the browser parses and runs it. This is a reflected/DOM sink triggered by data that transits a trusted third-party API (Telegram), which is why classic server-side WAF filtering does not see the malicious string in the inbound request to WordPress.

RemediationAI

A source-code fix appears in the plugin's trunk changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3449367%40telsender&new=3449367%40telsender), so an upstream fix is available but a specific tagged patched release version is not independently confirmed from the provided data - administrators should update TelSender to the latest available version above 1.14.14 once published and verify the changeset is included. Until a confirmed patched release is applied, reduce exposure by restricting which Telegram chats/bots the plugin queries so titles cannot be attacker-controlled, avoiding the 'Tested' button on the settings page in untrusted contexts, and limiting access to wp-admin (IP allowlisting or requiring VPN) so only trusted administrators can trigger the vulnerable DOM sink; the trade-off is that admin-network restrictions add operational friction and disabling the test workflow removes a diagnostic convenience. Confirm the fix and affected-version details against the Wordfence advisory before closing the finding.