PT-2026-57073 · Pechenki · Telsender – Сontact Form 7

Kai Aizen · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-15298

Mitre

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator opens the TelSender settings page and clicks the "Tested" button.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-15298

Produtos afetados

Telsender – Сontact Form 7

Referências · 9

• https://plugins.trac.wordpress.org/browser/telsender/tags/1.14.14/js/ajax.js#L119 · Nota
• https://plugins.trac.wordpress.org/browser/telsender/tags/1.14.14/js/ajax.js#L139 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/cb02878a-2c85-4dcb-bdc0-e65addf9fb9c?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449367%40telsender&new=3449367%40telsender&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/telsender/trunk/js/ajax.js#L139 · Nota
• https://plugins.trac.wordpress.org/browser/telsender/trunk/template/view.php#L111 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-15298 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/telsender/trunk/js/ajax.js#L119 · Nota
• https://plugins.trac.wordpress.org/browser/telsender/tags/1.14.14/template/view.php#L111 · Nota