CVE-2026-23807

A vulnerability exists in the WP Telegram Widget and Join Link plugin, allowing malicious actors to inject unwanted code onto vulnerable WordPress sites running version 2.2.13 or earlier. This occurs due to inadequate validation of incoming data and insufficient protection against malicious scripting. An attacker can exploit this weakness by convincing a user to click on a specially crafted link, potentially leading to unauthorized actions being performed on the targeted site.

Based on public CVE data (MITRE/NVD).