CVE-2026-93514
HighCVSS 7.1Summary
The Notification for Telegram plugin versions 3.5.2 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk of session theft, cookie theft, or other user data compromise, as well as account takeover.
Recommendation
Update the Notification for Telegram plugin to the latest version that includes the fix.
Other vulnerabilities in Notification for Telegram
See all- CVE-2026-7620Medium
The Notification for Telegram plugin for WordPress up to version 3.5.1 contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
- CVE-2026-40732High
Versions of Notification for Telegram <= 3.5 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS