CVE-2026-17005: CWE-79 Cross-Site Scripting (XSS) in Horizontal scrolling announcements

CVE-2026-17005 is a stored Cross-Site Scripting vulnerability in the Horizontal scrolling announcements WordPress plugin through version 2.6. The flaw arises from improper sanitization and escaping of an announcement setting before it is rendered in an attribute context on the front end. This allows users with Contributor or higher privileges to inject malicious scripts that execute in the browsers of visitors viewing the announcements.

An attacker with Contributor or higher privileges can inject persistent malicious scripts into announcements. These scripts execute in the browsers of users viewing the announcements, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires authenticated access with specific privileges, limiting exposure to authorized users.

No patch or official fix is currently documented. Users should restrict announcement management access to trusted users only and monitor for suspicious activity. Check the plugin vendor's advisory or updates for any forthcoming patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.