The milmor Telegram Bot & Channel WordPress plugin versions up to 4.1 suffer from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the Telegram username input is not adequately sanitized or escaped, enabling unauthenticated attackers to inject malicious scripts that execute in the context of users visiting affected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). No patch or remediation details have been provided by the vendor as of the publication date.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the browsers of users visiting the affected pages, potentially leading to theft of sensitive information or manipulation of content. The impact affects confidentiality and integrity but not availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or restricting access to pages where the Telegram username is displayed to trusted users only. Avoid using untrusted input in the Telegram username field. Monitor the vendor's communications for updates on patches or official mitigations.