CVE-2026-17005: Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Users who have access to the plugin's announcement management page can exploit it. This includes Contributor-level users and above when they have been permitted to access that page.
Who is exposed to the injected script?
The script executes in the browser of anyone who views the affected announcement on the front end. This can include site visitors as well as authenticated users, depending on where the announcement is displayed.
What input is vulnerable?
One announcement setting used as a style field is not sanitised or escaped before being placed into an HTML attribute on the front end. An authorized low-privilege user can store a malicious payload in that setting.