CVE-2024-5575 Ditty < 3.1.43 - Author+ Stored XSS

2024-07-1306:00:12

WPScan

www.cve.org

cve-2024-5575

ditty plugin

stored xss

wordpress plugin

EPSS

Percentile

9.3%

JSON

The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks’ settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Ditty ",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "3.1.43"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/65d1abb7-92e9-4cc4-a1d0-84985b484af3/

EPSS

Percentile

9.3%

JSON

Related for CVELIST:CVE-2024-5575