CVE-2025-13068: Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username
The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13068?
CVE-2025-13068 has been classified with a severity that allows for Stored Cross-Site Scripting attacks due to inadequate input sanitization.
How do I fix CVE-2025-13068?
To fix CVE-2025-13068, update the Telegram Bot & Channel plugin for WordPress to version 4.2 or higher.
Who is affected by CVE-2025-13068?
All users of the Telegram Bot & Channel plugin for WordPress on versions up to and including 4.1 are affected by CVE-2025-13068.
What type of attack can be executed through CVE-2025-13068?
CVE-2025-13068 allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks.
Is there a patch available for CVE-2025-13068?
Yes, a patch is available in the form of an updated version of the Telegram Bot & Channel plugin, specifically version 4.2 and above.