Horizontal Scrolling Announcements
Monthly
Stored cross-site scripting in the WordPress plugin Horizontal Scrolling Announcements (all versions through 2.6) allows an authenticated user holding access to the plugin's announcement management page - Contributor level or higher, once that permission is granted - to save a payload into an unsanitised announcement setting that is rendered unescaped into an HTML attribute on the front end, so the script executes in the browser of anyone viewing the announcement. Publicly available exploit code exists (the WPScan disclosure is referenced as an exploit source), but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Our independent assessment places real-world priority as LOW: exploitation is not remote-unauthenticated, it is limited to one specific setting, and it additionally requires victim interaction (someone must load a page that renders the stored announcement).
Stored cross-site scripting in the WordPress plugin Horizontal Scrolling Announcements (all versions through 2.6) allows an authenticated user holding access to the plugin's announcement management page - Contributor level or higher, once that permission is granted - to save a payload into an unsanitised announcement setting that is rendered unescaped into an HTML attribute on the front end, so the script executes in the browser of anyone viewing the announcement. Publicly available exploit code exists (the WPScan disclosure is referenced as an exploit source), but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Our independent assessment places real-world priority as LOW: exploitation is not remote-unauthenticated, it is limited to one specific setting, and it additionally requires victim interaction (someone must load a page that renders the stored announcement).