The vulnerability resides in the Telegram Bot & Channel plugin for WordPress, where the Telegram username field is insufficiently sanitized before it is stored and later output without proper escaping. This flaw allows an attacker who does not need authentication to embed arbitrary client‑side scripts that will run when any user views a page containing the injected username. The result is typical XSS abuse: session hijacking, credential theft, defacement or execution of malicious payloads in the context of the visiting user. The weakness is cataloged as CWE‑79, a classic unvalidated input scenario leading to script injection.

Any WordPress site that installed the Telegram Bot & Channel plugin in any version up to and including 4.1 is affected. The plugin is maintained by the milmor vendor within the WordPress ecosystem.

The CVSS score of 7.2 signifies high potential impact, yet the EPSS score of less than 1% indicates that the likelihood of exploitation remains low at this time. The vulnerability is not listed in CISA KEV, suggesting no known large‑scale exploit activity. Attackers can achieve exploitation simply by submitting a malicious username via the plugin interface; no additional credentials or privileged access are required.