Notification for Telegram CVE-2026-93514

Exploitation requires the Notification for Telegram WordPress plugin (version 3.5.2 or earlier) to be installed and active on the target site, and - per UI:R - a victim (typically an administrator or logged-in user) must load the page where the attacker's payload is rendered for the script to execute. No authentication is required to inject the payload (PR:N), but success is limited by the need for victim interaction, the client-side-only impact (no direct server compromise), and the plugin's relatively small deployment footprint. The specific vulnerable endpoint or input parameter is not detailed in the source data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated (PR:N) stored/reflected XSS whose scope-change (S:C) reflects script executing in the victim's browser context distinct from the vulnerable plugin, but the low C/I/A impacts and required user interaction (UI:R) place real-world severity well below the raw 7.1. There is no EPSS score, no CISA KEV listing, and no public POC referenced - only a single Patchstack database entry - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data is provided. Net assessment: a genuine unauthenticated XSS worth patching, but the combination of client-side-only impact, required victim interaction, and a niche plugin footprint makes this a moderate rather than urgent priority; there are no conflicting signals in the data, and the description text ('Unauthenticated') is consistent with the PR:N in the vector.

An unauthenticated attacker submits crafted input to a form or endpoint exposed by the Notification for Telegram plugin (version 3.5.2 or earlier) that is later rendered without proper sanitization. When an administrator or other user views the affected page, the injected JavaScript executes in their browser session, potentially enabling session/cookie theft or admin actions via the victim's authenticated context. No public exploit code is referenced, so exploitation would require an attacker to derive the injection vector themselves.