Metaphorcreations Ditty vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Metaphorcreations Ditty: 5 record(s), with affected versions and fixes.
CVE-2026-94461
Medium · 6.5
CWE-79 Sep 23, 2026
WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
CVE-2026-93339
Medium · 5.4
CWE-79 Sep 21, 2026
Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
CVE-2026-81274
Medium · 5.3
CWE-862 Aug 27, 2026
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
CVE-2026-27355
Medium · 5.3
CWE-862 Jul 23, 2026
WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2025-60105
Medium · 6.5
CWE-79 Sep 26, 2025
WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.