Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 18

Export CSV
CVE-2026-93339

Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations Wordpress
Products
Ditty Wordpress
CVE-2026-9011

Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action

The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations Wordpress
Products
Ditty – Responsive News Tickers, Sliders, And Lists Wordpress
CVE-2023-47764

WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability

Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2024-32569

WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2025-60105

WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations Wordpress
Products
Ditty Wordpress
CVE-2025-8085

Ditty < 3.1.58 - Unauthenticated SSRF

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

CVSS 3.1 · 8.6 High EPSS 20.5% KEV · Not listed
Vendors
Metaphorcreations Wordpress
Products
Ditty Wordpress
CVE-2024-13357

Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS

The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2024-3939

Ditty < 3.1.36 - Author+ Stored XSS

The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2024-6715

Ditty 3.1.39-3.1.45 - Author+ Stored XSS

The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2024-9600

Ditty < 3.1.47 - Author+ Stored XSS

The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2024-5575

Ditty < 3.1.43 - Author+ Stored XSS

The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2023-4148

Ditty < 3.1.25 - Reflected XSS

The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2023-23874

WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2022-0533

Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)

The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty
CVE-2024-6710

Ditty < 3.1.45 - Author+ Stored XSS

The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Ditty