CVE-2026-17005

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

WordPress Horizontal scrolling announcements plugin <= 2.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by testoun in WordPress Plugin Horizontal scrolling announcements versions = 2.6...

CVE-2026-17005 Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

CVE-2026-17005

The Horizontal scrolling announcements WordPress plugin (versions

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

CVE-2026-17005 Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

PT-2026-104608

Name of the Vulnerable Software and Affected Versions Horizontal scrolling announcements versions prior to 2.7 Description The plugin fails to sanitize and escape an announcement setting before it is output into an attribute context on the front end. This allows users with access to the...

CVE-2026-17005: Improper Neutralization of Input During Web Page Generation

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

CVE-2023-5000

The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2023-5000 Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode

The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2024-13845

Name of the Vulnerable Software and Affected Versions Horizontal scrolling announcements plugin for WordPress versions up to, and including, 2.4 Description The issue arises from insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in t...

CVE-2023-5000: Improper Neutralization of Special Elements used in an SQL Command

The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

WordPress plugin for horizontal scrolling announcements: security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...