CVE-2026-40732: WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a stored or reflected cross-site scripting (XSS) vulnerability in the Notification for Telegram WordPress plugin, versions 3.5 and earlier. The flaw is reachable over the network without any authentication, but requires a victim to interact with malicious content, such as clicking a crafted link or visiting a page containing injected script. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially reading session data, injecting content, or disrupting the page. No fix version has been published yet; HarborGuard tracks the advisory and will flag a patched-image rebuild as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential is needed; the attacker can interact with the vulnerable component as an anonymous user.

• Victim interactionRequired

  A victim must take an action, such as clicking a crafted link or loading a page containing the injected payload, for the script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Reads browser-accessible session tokens or authentication cookies belonging to the victim, which can be used to hijack their WordPress session.
• Injects arbitrary content or redirects into the page as rendered in the victim's browser, enabling phishing or defacement within the site context.
• Performs actions on the WordPress site on behalf of the victim, using their privilege level, such as changing settings or posting content.
• Disrupts the victim's page experience by modifying or removing rendered content, causing partial denial of service at the browser level.