CVE-2026-17005

6.8 Moyenne

Publiée le 04/10/2026 à 09:16 · Modifiée le 06/10/2026 à 17:18 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

Traduire en français

Produits concernés

Unknown Horizontal scrolling announcements

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/e3973475-18c4-46a0-b0ca-24e4d2cd58ca/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories