CVE-2026-17005
Received Received - Intake

Stored XSS in Horizontal Scrolling Announcements WordPress Plugin

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: WPScan

Description
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-17005
EUVD
EUVD-2026-92071

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Horizontal Scrolling Announcements WordPress plugin version 2.6 or below. It occurs because the plugin fails to properly sanitize and escape user input in the style field of announcements. Users with Contributor-level access or higher can inject malicious scripts that execute in the browsers of visitors viewing the affected announcement.

Detection Guidance

Check if the Horizontal Scrolling Announcements WordPress plugin version 2.6 or below is installed. Inspect announcement settings for unsanitized input in the style field. Look for stored scripts in announcements visible to users.

Impact Analysis

Attackers with Contributor access or higher could inject malicious scripts into announcements. These scripts would run in the browsers of anyone viewing the announcement, potentially stealing cookies, session tokens, or sensitive data, or performing actions on behalf of the user without their consent.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. It may result in non-compliance, legal penalties, or reputational damage due to compromised user data.

Mitigation Strategies

Update the Horizontal Scrolling Announcements plugin to the latest version. Remove or restrict Contributor-level access to announcement management. Review announcements for malicious scripts and remove any suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17005. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart