Stored Cross-Site Scripting Vulnerability in Telegram for WP Plugin by WordPress

CVE-2025-5939

What is CVE-2025-5939?

The Telegram for WP plugin in WordPress is susceptible to a Stored Cross-Site Scripting attack, which affects all versions up to 1.6.1. This vulnerability arises from inadequate input sanitization and output escaping in the plugin's admin settings. Authenticated users with administrator-level permissions can exploit this flaw to inject malicious web scripts into pages. These scripts may execute when other users access the compromised pages, posing significant security risks, particularly on multi-site installations or environments where unfiltered_html is disabled.

References