pechenki vulnerabilities

Products

• TelSender 1
• TelSender – Сontact form 7, Events, Wpforms, ninja forms and woocommerce to telegram bot 1

Latest pechenki CVEs

Newest publication first

1. CVE-2026-15298 TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title

   Published 2026-07-10

   High·CVSS 7.2 EPSS 0.43%

   The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possib...

2. CVE-2023-41683 WordPress TelSender plugin <= 1.14.11 - Broken Access Control + CSRF vulnerability

   Published 2024-12-13

   Medium·CVSS 5.4 EPSS 0.57%

   Missing Authorization vulnerability in Pechenki TelSender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TelSender: from n/a through 1.14.11.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.