The TelSender plugin processes responses from Telegram's API and stores chat titles without sanitization. The unsanitized titles are later rendered in the plugin’s settings page, allowing an attacker to embed malicious scripts in the title. When an administrator visits the settings page and clicks the "Tested" button, the injected script runs with the administrator's privileges, constituting a DOM-based cross-site scripting vulnerability that requires no authentication to inject but relies on an authenticated user to trigger the payload.

All versions of the TelSender WordPress plugin up to and including 1.14.14 are affected. This plugin is often used to forward submissions from Contact Form 7, Events, WPForms, Ninja Forms and WooCommerce to a Telegram bot, so any WordPress site employing those integrations with an affected TelSender release is vulnerable. The flaw resides in the plugin’s AJAX handler and PHP template that render the settings page, targeting administrators who have the "Tested" button enabled.

The CVSS score is 7.2, indicating a medium to high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attacker only needs to inject a malicious title but to execute the payload an administrator must click the "Tested" button, the risk is limited to privileged users of the affected site. Successful exploitation would allow arbitrary JavaScript execution, session hijacking, data exfiltration, or loading additional malware, thereby compromising confidentiality, integrity, and availability of the site's administration interface.