CVE-2023-34006

28th percentile - higher than 28% of all known CVEs

The Marco Milesi Telegram Bot & Channel plugin versions up to 3.6.2 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.

Organizations using this plugin may be exposed to session data theft, user account takeover, and other XSS-related attacks. Specifically, an attacker could manipulate the user interface or steal sensitive information.

It is recommended to update the Marco Milesi Telegram Bot & Channel plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application is advisable to identify other potential flaws.