CVE-2026-15298 describes a DOM-Based Cross-Site Scripting vulnerability in the TelSender plugin for WordPress (versions up to and including 1.14.14). The issue is caused by improper neutralization of input when processing Telegram API responses containing attacker-controlled chat titles. This allows unauthenticated attackers to inject malicious scripts that execute in the context of the administrator's browser upon interacting with the plugin's settings page and triggering the "Tested" button. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2, indicating a high severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

An unauthenticated attacker can inject and execute arbitrary scripts in the administrator's browser context when the TelSender settings page is accessed and the "Tested" button is clicked. This can lead to partial compromise of confidentiality and integrity of the administrator's session or data. There is no direct impact on availability. The vulnerability affects all versions up to and including 1.14.14 of the TelSender plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking the "Tested" button on the TelSender settings page when untrusted Telegram chat titles might be present. Monitor vendor channels for updates and apply patches promptly once released.