EUVD-2026-92071
GHSA-6g7j-p76q-h89g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor+ access to plugin admin page
-
DeliveryInject payload into announcement setting
-
ExploitPayload stored unescaped in attribute context
-
ExecutionVictim views front-end announcement
-
PersistScript executes in victim browser
-
ImpactHijack session / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with access to the plugin's announcement management page - Contributor role or higher, 'once permitted' - and the attacker must inject the payload into the specific unsanitised announcement setting that is output into an HTML attribute context on the front end. It further requires victim user interaction: someone must view a page that renders the stored announcement for the script to fire. Limiting factors: this is NOT remote-unauthenticated (an account and announcement-management permission are prerequisites), the injection point is a single specific setting, and the affected software is the 'Horizontal scrolling announcements' plugin at versions through 2.6 only. |
| Impact | This is a stored XSS (CWE-79) in a niche WordPress plugin, and the combined signals point to LOW real-world priority despite a mid-range CVSS of 6.8. EPSS is just 0.15% (4th percentile), it is NOT on CISA KEV, and exploitation requires an authenticated user with access to the announcement management page plus a victim viewing the announcement. A public POC exists via WPScan, but POC availability is a capability signal, not evidence of active exploitation - the two must not be conflated. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) is internally inconsistent with the description: it rates privileges as PR:H, yet the description states the attacker only needs Contributor-level access ('Contributor and above'), which is a LOW-privilege role - so PR:L is more defensible. The C:H/I:H/A:H impact and S:U (unchanged scope) are also questionable for a browser-side stored XSS, which typically yields limited impact and a scope change (S:C), inflating the base score. Net: a genuine but low-urgency, authenticated, user-interaction-dependent vulnerability in a low-footprint product - patch in normal cycles rather than treat as an emergency. |
| Exploit ScenarioDerived | A user with Contributor-or-higher access to the plugin's announcement management page saves an announcement setting containing a malicious payload that is written unescaped into an HTML attribute on the front end. When any visitor or administrator later views a page rendering that announcement, the script executes in their browser, enabling session/cookie theft or actions in the victim's context. A public proof-of-concept is available from WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Stored cross-site scripting in the WordPress plugin Horizontal Scrolling Announcements (all versions through 2.6) allows an authenticated user holding access to the plugin's announcement management page - Contributor level or higher, once that permission is granted - to save a payload into an unsanitised announcement setting that is rendered unescaped into an HTML attribute on the front end, so the script executes in the browser of anyone viewing the announcement. Publicly available exploit code exists (the WPScan disclosure is referenced as an exploit source), but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Our independent assessment places real-world priority as LOW: exploitation is not remote-unauthenticated, it is limited to one specific setting, and it additionally requires victim interaction (someone must load a page that renders the stored announcement).
RemediationAI
No vendor-released patch was identified in the available intelligence at time of analysis - the affected range is stated only as 'through 2.6' with no successor fix version published - so remediation must be compensating rather than version-based: check the plugin page/changelog and the WPScan advisory (https://wpscan.com/vulnerability/e3973475-18c4-46a0-b0ca-24e4d2cd58ca/) for a fixed release and upgrade immediately when one appears. Until then, the most effective control is to deactivate and remove the Horizontal Scrolling Announcements plugin entirely, accepting the loss of the announcement ticker functionality. If the plugin must stay, restrict the announcement-management capability so that only fully trusted roles (Administrator/Editor, not Contributor) can edit announcement settings, and revoke any Contributor-level grants previously made, understanding this reduces but does not eliminate risk if a trusted account is compromised. Audit existing stored announcement settings for injected quotes, script/style tags or event-handler attributes and clean them, and deploy a Content-Security-Policy that forbids inline script (script-src without 'unsafe-inline', or with nonces/hashes) to prevent the stored payload from executing - noting that inline-script restrictions commonly break other plugins and theme scripts and require testing. A WAF rule blocking quote/tag sequences in announcement submissions offers a further layer but is bypassable and does not fix the underlying missing output escaping.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (improper neutralization of input during web page generation), specifically a stored/persistent XSS in an attribute context: one of the plugin's announcement settings is saved by an administrative user and then echoed into an HTML attribute (for example a title, style or data-* attribute) on the front end without esc_attr()-style output encoding, so a quote-and-tag-breaking payload stored in that setting is parsed as markup when the announcement renders. The affected component is the WordPress plugin 'horizontal_scrolling_announcements' (CPE cpe:2.3:a:unknown:horizontal_scrolling_announcements, version wildcard - the CPE publisher field is recorded as unknown, so version matching relies on the EUVD range 'Horizontal scrolling announcements 0 ≤ 2.6'); the advisory originates from WPScan and is mirrored by VulDB and EUVD. WordPress role capabilities are central to the prerequisites: the attacker needs an account that has been permitted to reach the plugin's announcement management page (Contributor and above, once permitted), so the vector is authenticated and, in the CVE/CVSS 3.1 record, is expressed as PR:H/UI:R with S:U. Our independent assessment re-scores this as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. a lower-privileged authenticated attacker with a scope change (the injected script runs in the victim's browser context, affecting resources beyond the vulnerable component) but limited confidentiality and integrity impact and no availability impact; the summary and remediation here follow that lower-impact, low-priority view.
Know when Horizontal Scrolling Announcements gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor-level access maps to PR:L (not PR:H); victim must view the page (UI:R); stored XSS executing in the victim's browser crosses a security boundary (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB