The Telegram for WP plugin for WordPress suffers from a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping in admin settings. This vulnerability allows authenticated users with administrator-level permissions or higher to inject arbitrary web scripts that execute when other users access the affected pages. The issue specifically impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled. The vulnerability is present in all versions up to and including 1.6.1. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An attacker with administrator-level permissions can inject persistent malicious scripts into pages generated by the plugin, potentially leading to unauthorized actions or data exposure when other users view those pages. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability only affects specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Administrators should review their use of the Telegram for WP plugin, especially in multi-site environments or where unfiltered_html is disabled, and consider restricting administrator access or disabling the plugin until a fix is released. Monitor the vendor's advisory channels for updates regarding a patch or official remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.