CVE-2026-17005

Published 4 October 2026 · tracked since 4 October 2026

Description

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted)

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-86817
• CVE-2026-93549
• CVE-2026-97332
• CVE-2026-104119
• CVE-2026-104118
• CVE-2026-105123 HIGH 8.8
• CVE-2026-105124 MEDIUM 6.1
• CVE-2026-105125 LOW 3.7
• CVE-2026-105118 MEDIUM 4.7
• CVE-2026-97873

→ Open the live CVE board · all tools