CVE-2026-17005

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-04

Last updated on: 2026-10-06

Assigner: WPScan

Description

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-04

EPSS Evaluated

2026-10-18

NVD

CVE-2026-17005

EUVD

EUVD-2026-92071

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Horizontal	scrolling announcements 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Horizontal Scrolling Announcements WordPress plugin version 2.6 or below. It occurs because the plugin fails to properly sanitize and escape user input in the style field of announcements. Users with Contributor-level access or higher can inject malicious scripts that execute in the browsers of visitors viewing the affected announcement.

Detection Guidance

Check if the Horizontal Scrolling Announcements WordPress plugin version 2.6 or below is installed. Inspect announcement settings for unsanitized input in the style field. Look for stored scripts in announcements visible to users.

Impact Analysis

Attackers with Contributor access or higher could inject malicious scripts into announcements. These scripts would run in the browsers of anyone viewing the announcement, potentially stealing cookies, session tokens, or sensitive data, or performing actions on behalf of the user without their consent.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. It may result in non-compliance, legal penalties, or reputational damage due to compromised user data.

Mitigation Strategies

Update the Horizontal Scrolling Announcements plugin to the latest version. Remove or restrict Contributor-level access to announcement management. Review announcements for malicious scripts and remove any suspicious content.

Hi! I’m here to help you understand CVE-2026-17005. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70