Telegram Bot & Channel

Telegram Bot & Channel has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 3 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).

Every one of the 3 issues recorded for Telegram Bot & Channel has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Telegram Bot & Channel is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.2.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Telegram Bot & Channel vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2025-13068

Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username

Read the full analysis

Vulnerability Records

3 records
Telegram Bot & Channel banner
Latestv4.2.1

Telegram Bot & Channel

Marco Milesi

Author

Marco Milesi

4.8(22)
96/100
Last Updated
2026-10-14 (14d ago)
Active Installs
500+
Downloads
85,204
Requires WP
4.6+
Requires PHP
7.0+
Tested up to
WP 7.2
Created
2015-09-07 (11y ago)

Telegram Bot & Channel connects your WordPress site to Telegram. Publish a post and your channel, groups and bot subscribers get it instantly; set up autoresponders and keyboards to turn your bot into a small interactive app, no coding required. Key features 📣 Broadcast – send posts, pages or custom messages to channels, groups, supergroups and bot subscribers ⏰ Automatic notifications – new and scheduled posts are sent on publish, using a configurable template 🤖 Responders – unlimited commands and autoresponders, with custom keyboards and inline buttons ✍️ Block editor support – choose whether and where to send directly from the post sidebar 👥 Subscribers & groups – list, edit and message your users, with per-user activity counters 📍 Location-aware replies – Haversine helpers to answer based on the user’s position 🔗 Zapier – connect Telegram with thousands of apps (RSS, Google Sheets, social networks and more) 🧩 Widget – let visitors join your bot or channel from the sidebar 🛠️ Developer friendly – PHP functions, actions and filters to extend everything Privacy & security Your data stays on your site: the plugin talks only to the Telegram Bot API (and Zapier, if you enable it) Messages are received through secure Telegram WebHooks (HTTPS required) All admin actions are protected by capability checks and WordPress nonces Activity logging can be disabled from the Advanced settings Open source Free, GPL licensed and developed on GitHub: github.com/WPGov/telegram-bot. Bug reports and pull requests are welcome!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C