Wptelegram Widget Vulnerabilities

The WP Telegram Widget and Join Link plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if the...

CVSS:

6.1

Affected:

up to 2.2.13

Fixed in:

2.2.14

Disclosed:

Mar 23, 2026

CVE-2026-23807 on NVD →

[en] Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.11.

Affected:

up to 2.2.11

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68589 on NVD →

The Telegram Widget and Join Link plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.2.12

Fixed in:

2.2.13

Disclosed:

Dec 22, 2025

CVE-2025-68589 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Socio WP Telegram Widget and Join Link allows Stored XSS.This issue affects WP Telegram Widget and Join Link: from n/a through 2.1.27.

Affected:

up to 2.1.28

Fixed in:

2.1.28

Disclosed:

Aug 18, 2024

CVE-2024-43309 on NVD →

The WP Telegram Widget and Join Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...

CVSS:

6.4

Affected:

up to 2.1.27

Fixed in:

2.1.28

Disclosed:

Aug 16, 2024

CVE-2024-43309 on NVD →