This vulnerability (CVE-2024-43309) in WP Socio's WP Telegram Widget and Join Link plugin allows stored cross-site scripting (CWE-79) due to improper input sanitization during web page generation. Attackers with at least low privileges and requiring user interaction can inject malicious scripts that execute in the context of affected users' browsers. The vulnerability affects all versions up to 2.1.27. No vendor advisory or patch is currently published, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates low attack complexity and partial privileges required, with impacts on confidentiality, integrity, and availability rated as low to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting plugin usage to trusted users, limiting user input where possible, and monitoring for suspicious activity related to the plugin. Avoid relying on generic mitigations as the vendor has not provided specific guidance or fixes yet.