CVE-2026-40732
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Versions of Notification for Telegram <= 3.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade to the latest version of Notification for Telegram to mitigate this vulnerability.
Other vulnerabilities in Notification for Telegram
See all- CVE-2026-93514High
The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-7620Medium
The Notification for Telegram plugin for WordPress up to version 3.5.1 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
- CVE-2025-62993Medium
The Notification for Telegram plugin up to version 3.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS