{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5939", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-09T15:51:41.340Z", "datePublished": "2025-06-13T01:47:50.112Z", "dateUpdated": "2026-04-08T17:24:38.135Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:38.135Z"}, "affected": [{"vendor": "amir-mousavi", "product": "Telegram for WP", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4a3171-f041-40ce-8148-239c24d7ce95?source=cve"}, {"url": "https://wordpress.org/plugins/telegram-for-wp/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-06-12T13:09:43.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-13T15:37:50.254579Z", "id": "CVE-2025-5939", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-13T15:39:55.852Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-13T15:37:50.254579Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-13T15:39:02.281Z"}}], "cna": {"title": "Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "amir-mousavi", "product": "Telegram for WP", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-12T13:09:43.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4a3171-f041-40ce-8148-239c24d7ce95?source=cve"}, {"url": "https://wordpress.org/plugins/telegram-for-wp/#developers"}], "descriptions": [{"lang": "en", "value": "The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:38.135Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5939", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:24:38.135Z", "dateReserved": "2025-06-09T15:51:41.340Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-13T01:47:50.112Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El complemento Telegram para WP para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 1.6.1 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con permisos de administrador o superiores, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-5939", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-06-13T03:15:53.200", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/telegram-for-wp/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4a3171-f041-40ce-8148-239c24d7ce95?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:33:27.032688+00:00", "value": {"mitigation_remediation": ["Upgrade Telegram for WP to a version newer than 1.6.1 once it becomes available", "Restrict or remove the ability of users with admin+ capabilities to edit plugin settings that can contain arbitrary code, or implement role\u2011based access controls to limit who can reach the settings page", "Ensure the unfiltered_html capability is only granted to trusted accounts and, where necessary, apply proper sanitization to the plugin\u2019s settings inputs before deployment"], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting via admin settings allowing arbitrary script injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Telegram for WP plugin distributed by amir\u2011mousavi in all releases up to and including version\u202f1.6.1. It is only relevant in multi\u2011site WordPress installations or in setups where the unfiltered_html capability has been disabled, which permits the insertion of unsanitized HTML.", "description_and_impact": "The Telegram for WP WordPress plugin contains a stored cross\u2011site scripting flaw that arises from insufficient input sanitization and output escaping in its admin settings pages. Authenticated users with administrator\u2011level permissions or higher can insert arbitrary web scripts that are stored and then executed whenever a visitor loads an affected page. This flaw directly matters for confidentiality, integrity, and availability of site content as it can be used to alter the user experience or deliver malicious payloads.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than\u202f1% shows a low probability of exploitation. The flaw is not listed in CISA KEV. Based on the description, the likely attack vector involves an authenticated admin+ user accessing the plugin\u2019s settings page to submit malicious script payloads that are then stored and served to site visitors."}}}}, "created": "2026-04-20T22:45:20.539044+00:00", "updated": "2026-04-20T22:45:20.539055+00:00", "vendors": []}