Pechenki - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/pechenki/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 10 Jul 2026 05:23:32 +0000CVE-2026-15298: WordPress TelSender Plugin DOM-Based Cross-Site Scriptinghttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-15298-telsender-xss/Fri, 10 Jul 2026 05:23:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-15298-telsender-xss/The TelSender plugin for WordPress, versions up to and including 1.14.14, is vulnerable to DOM-Based Cross-Site Scripting (CWE-79), allowing unauthenticated attackers to inject malicious scripts via Telegram chat titles which execute within an administrator's browser upon interacting with the plugin's settings.A DOM-Based Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-15298, has been identified in the TelSender plugin for WordPress, affecting all versions up to and including 1.14.14. This vulnerability stems from insufficient input sanitization when the plugin processes Telegram API responses, specifically those containing attacker-controlled chat titles. Exploitation of this flaw enables unauthenticated attackers to inject arbitrary malicious scripts. These scripts are then executed in the context of an administrator's browser when they access the TelSender settings page and click the "Tested" button. This interaction triggers the client-side rendering of the unsanitized Telegram chat title, leading to the execution of the attacker's script. The vulnerability poses a significant risk as it can lead to session hijacking, credential theft, or further compromise of the WordPress site.

Attack Chain

  1. Attacker Controls Telegram Chat Title: An unauthenticated attacker registers a Telegram chat or group and sets its title to contain malicious JavaScript payload (e.g., <script>alert(document.cookie)</script>).
  2. TelSender Plugin Connects to Telegram: The legitimate WordPress site administrator configures and connects the TelSender plugin to their Telegram account, allowing it to retrieve Telegram API responses, including chat titles.
  3. Malicious Chat Title Stored/Processed: The TelSender plugin processes the Telegram API response, which includes the attacker-controlled chat title. Due to insufficient sanitization, the malicious script within the chat title is embedded into the plugin's data structures or directly into the DOM.
  4. Administrator Accesses Settings: The administrator navigates to the TelSender plugin's settings page within the WordPress admin dashboard.
  5. Administrator Clicks "Tested" Button: The administrator interacts with the settings page, specifically clicking the "Tested" button. This action triggers the vulnerable client-side code within the plugin.
  6. DOM-Based XSS Execution: The plugin's JavaScript code renders the previously processed (and unsanitized) Telegram chat title directly into the Document Object Model (DOM) of the administrator's browser.
  7. Malicious Script Execution: The injected malicious JavaScript payload executes within the administrator's browser context, potentially leading to session hijacking, credential theft, or further administrative actions on the WordPress site.

Impact

Successful exploitation of CVE-2026-15298 allows unauthenticated attackers to execute arbitrary JavaScript code within the context of an administrator's browser. This can lead to severe consequences, including but not limited to, complete administrative control over the affected WordPress website, theft of sensitive information (e.g., session cookies, login credentials), redirection of users to malicious sites, or defacement. While no specific victim numbers are available, WordPress plugins are widely deployed, making this a critical concern for organizations utilizing the TelSender plugin. Compromise of an administrator account can enable further attacks, including malware distribution or data exfiltration.

Recommendation

  • Upgrade Immediately: Patch the TelSender plugin to a version beyond 1.14.14 as soon as a fix is released to mitigate CVE-2026-15298.
  • Disable Vulnerable Plugin: If an immediate patch is not available, disable or uninstall the TelSender plugin to remove the attack vector until a secure version can be deployed.
  • Educate Administrators: Advise WordPress administrators to exercise caution when interacting with plugin settings, especially those that process external data, and to ensure all plugins are regularly updated.
]]>highadvisorywordpresspluginxssweb-applicationcve