High · 7.1 CVE-2026-40732 EUVD-2026-36972GHSA-2jm3-gfcg-hh57

WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Published Jun 15, 2026 · Updated Jun 16, 2026 · Assigned by Patchstack

Vendor: rainafarai Product: Notification for Telegram

Description

Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.

Affected products

Vendor	Product	Affected	Fixed
rainafarai	Notification for Telegram	≤ 3.5	—

References

https://patchstack.com/database/wordpress/plugin/notification-for-telegram/vulnerability/wordpress-notification-for-telegram-plugin-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry