Telsender – Сontact Form 7, Events, Wpforms, Ninja Forms And Woocommerce To Telegram Bot
Approved changes feed: RSS · Atom
cpe:2.3:a:pechenki:telsender_–_сontact_form_7,_events,_wpforms,_ninja_forms__and_woocommerce_to_telegram_bot:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pechenki (7cff747a-82d8-5d8d-9979-5a2aea23f6d2) |
|---|---|
| Product | Telsender – Сontact Form 7, Events, Wpforms, Ninja Forms And Woocommerce To Telegram Bot (ac55ce4e-bf83-5620-98fb-8d0e4915db7f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15298 |
vulnerable | 2026-07-29 00:26:17.977510 |
TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title
HIGH (7.2)
The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator opens the TelSender settings page and clicks the "Tested" button.
Published: 2026-07-10T04:31:26.785Z
Updated: 2026-07-10T17:01:43.683Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.