CVE-2026-15298

Name of the Vulnerable Software and Affected Versions TelSender versions prior to 1.14.15

Description Insufficient input sanitization when processing Telegram API responses allows unauthenticated attackers to perform DOM-Based Cross-Site Scripting (XSS). This occurs when the plugin handles attacker-controlled chat titles, enabling the injection of malicious scripts. The scripts execute when an administrator accesses the TelSender settings page and interacts with the "Tested" button.

Recommendations Update TelSender to a version newer than 1.14.14. As a temporary mitigation, disable the plugin until a fix is applied.