Horizontal scrolling announcements
Horizontal scrolling announcements has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is SQL Injection, behind 1 of the records (100%).
The one issue recorded for Horizontal scrolling announcements has a vendor fix available, so running the current release closes it.
All of these findings were reported by István Márton. Horizontal scrolling announcements is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-5000Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode
Read the full analysisVulnerability Records

Horizontal scrolling announcements
Author
gopiplus
This horizontal scrolling announcement wordpress plugin lets scroll the content from one end to another end like reel. This plugin is using JQuery Marquee script for scrolling. This is the simple way to create scrolling text in your website. Check official website for live demo http://www.gopiplus.com/work/2010/07/18/horizontal-scrolling-announcement/ Live demo Live Demo Documentation Frequently Asked Questions Feature Free plugin. Easy to customize. It supports all major browsers. Configurable scroll speed. Pause the scroll on mouse over. Option to set announcement start date. Option to set expiration date/time for the announcement. Short code for post You can add your announcement into your wordpress post with the following shortcode. [hsas-shortcode group="" speed="10" direction="left" gap="50"] [hsas-shortcode group="" speed="2" direction="down" gap="50"] If you want to include this announcement in your custom theme, please look at the do_shortcode option in wordpress. echo do_shortcode( '[hsas-shortcode group="" speed="10" direction="left" gap="50"]' );
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C