CVE-2025-5236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5236", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-26T21:45:11.845Z", "datePublished": "2025-05-30T07:23:41.129Z", "dateUpdated": "2026-04-08T17:00:43.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:43.864Z"}, "affected": [{"vendor": "ninjateam", "product": "WP Telegram Chat Widget", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018username\u2019 parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/725feb15-aa9b-4c00-bb95-ee0616000a14?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ninjateam-telegram/trunk/blocks/src/init.php#L130"}, {"url": "https://wordpress.org/plugins/ninjateam-telegram/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3302588/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-05-29T18:49:32.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T13:55:42.829851Z", "id": "CVE-2025-5236", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T13:55:53.939Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5236", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-30T13:55:42.829851Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T13:55:49.591Z"}}], "cna": {"title": "NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ninjateam", "product": "WP Telegram Chat Widget", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-29T18:49:32.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/725feb15-aa9b-4c00-bb95-ee0616000a14?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ninjateam-telegram/trunk/blocks/src/init.php#L130"}, {"url": "https://wordpress.org/plugins/ninjateam-telegram/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3302588/"}], "descriptions": [{"lang": "en", "value": "The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018username\u2019 parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:43.864Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5236", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:00:43.864Z", "dateReserved": "2025-05-26T21:45:11.845Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-30T07:23:41.129Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Telegram Chat Widget", "vendor": "ninjateam", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ninjateam:chat_for_telegram:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "5A964C02-9362-43EA-987E-E7B88D97574E", "versionEndExcluding": "1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018username\u2019 parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento NinjaTeam Chat para Telegram de WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro \"username\" en todas las versiones hasta la 1.1 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5236", "lastModified": "2026-06-17T09:47:31.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5236", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-30T13:55:42.829851Z", "version": "2.0.3"}}]}, "published": "2025-05-30T08:15:19.710", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ninjateam-telegram/trunk/blocks/src/init.php#L130"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3302588/"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/ninjateam-telegram/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/725feb15-aa9b-4c00-bb95-ee0616000a14?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:35:09.196986+00:00", "value": {"mitigation_remediation": ["Delete or downgrade the NinjaTeam Chat for Telegram plugin to a version known to exclude the vulnerability (or wait for a vendor patch).", "If removal is not possible, limit the block\u2019s visibility to administrators only or disable the widget entirely until a fix is available.", "Configure the web application firewall or Content Security Policy to block JavaScript injection attempts in the username field and escape user\u2010supplied content before rendering."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via username parameter"}, "threat_synthesis": {"affected_systems": "WordPress sites using the NinjaTeam Chat for Telegram plugin from any version up to and including 1.1 are affected. The vendor is ninjateam and the product is the WP Telegram Chat Widget. No newer versions are known to fix the issue, so all installations of 1.1 and earlier are vulnerable.", "description_and_impact": "The NinjaTeam Chat for Telegram WordPress plugin contains a stored cross\u2011site scripting flaw triggered by the username field. The plugin fails to sanitize or escape the input before storing it, allowing attackers with Contributor\u2011level or higher access to insert arbitrary JavaScript. When a page containing the injected username is later viewed, the malicious script executes in the victim\u2019s browser, potentially hijacking sessions, defacing content, or performing other covert actions. This vulnerability directly compromises the integrity and confidentiality of website users browsing affected pages.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that the exploitation probability is low at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor\u2011level or higher privileges; the attacker must submit a crafted username value that is then rendered on subsequent pages accessed by other users. Once injected, the script executes in the context of every visitor who loads the affected page."}}}}, "created": "2026-04-21T20:45:25.974238+00:00", "updated": "2026-04-21T20:45:25.974250+00:00", "vendors": []}