Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action
medium
The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and abov...
- CVSS:
- 4.3
- Affected:
- up to 3.5.1
- Fixed in:
- 3.5.2
- Disclosed:
- Jul 10, 2026
CVE-2026-7620 on NVD →
Notification for Telegram <= 3.5 - Unauthenticated Stored Cross-Site Scripting
high
The Notification for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use...
- CVSS:
- 7.2
- Affected:
- up to 3.5
- Fixed in:
- 3.5.1
- Disclosed:
- Apr 20, 2026
CVE-2026-40732 on NVD →
Notification for Telegram <= 3.5.1 - Missing Authorization
medium
The Notification for Telegram plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 3.5.1
- Fixed in:
- 3.5.2
- Disclosed:
- Nov 29, 2025
CVE-2025-62993 on NVD →
Notification for Telegram <= 3.5.1 - Cross-Site Request Forgery
medium
The Notification for Telegram plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a...
- CVSS:
- 4.3
- Affected:
- up to 3.5.1
- Fixed in:
- 3.5.2
- Disclosed:
- Sep 5, 2025
CVE-2025-58794 on NVD →
Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message
medium
The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_action' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a test m...
- CVSS:
- 4.3
- Affected:
- up to 3.3.1
- Fixed in:
- 3.3.2
- Disclosed:
- Oct 9, 2024
CVE-2024-9685 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database