rootpwn

medium · CVSS v3 5.4 · EPSS 0.00152

CVE-2026-17005

The Horizontal scrolling announcements WordPress plugin up to version 2.6 contains a stored XSS vulnerability that allows privileged users t

Overview

The Horizontal scrolling announcements WordPress plugin up to version 2.6 contains a stored XSS vulnerability that allows privileged users to inject malicious scripts into announcement attributes. This flaw can be exploited by contributors or higher roles to execute code in the browsers of any site visitor who views the affected announcement. The vulnerability is medium severity with a low EPSS score, indicating limited but still relevant risk.

Description

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

Impact

Confidentiality is not directly compromised. Integrity can be affected as malicious scripts alter page content. Availability is not impacted. Site administrators and visitors viewing announcements are at risk of XSS execution.

Remediation

Apply the latest plugin update (v2.7 or later) which sanitises announcement inputs. If an update is unavailable, disable the plugin or restrict Contributor and higher roles from accessing the announcement management page. Additionally, implement a site-wide CSP that blocks inline scripts.

Risk context

Medium severity with an EPSS of 0.00152 indicates a low probability of exploitation but still warrants prompt patching to prevent XSS attacks.

Affected products

  • WordPress
  • Horizontal scrolling announcements plugin
  • WordPress plugin

Scores

Severity
medium
CVSS v2
3.5
CVSS v3
5.4
CVSS v4
—
EPSS
0.00152

XSS WordPress Stored XSS Plugin Contributor Medium EPSS

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis