CVE-2025-5939

Vulnerability

The Telegram for WP plugin for WordPress versions up to and including 1.6.1 contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings. The flaw arises from insufficient input sanitization and output escaping, allowing injection of arbitrary web scripts. This vulnerability specifically affects multi-site installations and any installation where the unfiltered_html capability has been disabled. The plugin has been closed from the WordPress.org directory as of June 11, 2025, citing a security issue, and no patched version was released [1].

Exploitation

An authenticated attacker with administrator-level permissions (or higher) can inject malicious scripts via the affected admin settings fields. The attacker must have the ability to save settings; the stored script will then execute whenever any user, including lower-privileged users, accesses the compromised admin page. The attack is limited to environments where unfiltered_html is not enabled (i.e., multisite or sites where that capability has been revoked) [1].

Impact

Successful exploitation allows the attacker to inject arbitrary web scripts that execute in the context of the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is constrained to the WordPress admin interface, but any user visiting the affected pages may be affected.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of June 11, 2025, due to an unresolved security issue. No patched version exists or is being distributed. Users should immediately uninstall the Telegram for WP plugin and consider alternative solutions. No workaround is available other than removal [1].