blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-17005

MEDIUM 6.8 CVSS 3.1
Published
October 4, 2026
Last modified
October 6, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

Affected WordPress components

  • Horizontal scrolling announcements Plugin · horizontal-scrolling-announcements
    Confirmed match Active
    Up to and including 2.6
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Horizontal scrolling announcements — Up to and including 2.6

References

  • wpscan.com https://wpscan.com/vulnerability/e3973475-18c4-46a0-b0ca-24e4d2cd58ca/
  • nvd.nist.gov Official NVD record