Threats tagged 'ghsa-6g7j-p76q-h89g'

The Horizontal scrolling announcements WordPress plugin up to version 2.6 contains a stored Cross-Site Scripting (XSS) vulnerability. This occurs because one of its announcement settings is not properly sanitized or escaped before being output into an attribute context on the front end. Users with Contributor or higher privileges who have access to the announcement management page can inject malicious scripts. These scripts execute in the browsers of anyone viewing the affected announcements, potentially compromising confidentiality, integrity, and availability.