Telegram Bot & Channel
Telegram Bot & Channel has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 3 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).
Every one of the 3 issues recorded for Telegram Bot & Channel has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Telegram Bot & Channel is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.2.
CVE-2025-13068Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username
Read the full analysisVulnerability Records

Telegram Bot & Channel
Author
Marco Milesi
Telegram Bot & Channel connects your WordPress site to Telegram. Publish a post and your channel, groups and bot subscribers get it instantly; set up autoresponders and keyboards to turn your bot into a small interactive app, no coding required. Key features 📣 Broadcast – send posts, pages or custom messages to channels, groups, supergroups and bot subscribers ⏰ Automatic notifications – new and scheduled posts are sent on publish, using a configurable template 🤖 Responders – unlimited commands and autoresponders, with custom keyboards and inline buttons ✍️ Block editor support – choose whether and where to send directly from the post sidebar 👥 Subscribers & groups – list, edit and message your users, with per-user activity counters 📍 Location-aware replies – Haversine helpers to answer based on the user’s position 🔗 Zapier – connect Telegram with thousands of apps (RSS, Google Sheets, social networks and more) 🧩 Widget – let visitors join your bot or channel from the sidebar 🛠️ Developer friendly – PHP functions, actions and filters to extend everything Privacy & security Your data stays on your site: the plugin talks only to the Telegram Bot API (and Zapier, if you enable it) Messages are received through secure Telegram WebHooks (HTTPS required) All admin actions are protected by capability checks and WordPress nonces Activity logging can be disabled from the Advanced settings Open source Free, GPL licensed and developed on GitHub: github.com/WPGov/telegram-bot. Bug reports and pull requests are welcome!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C