189 matches found
Ditty < 3.1.25 - Cross-Site Scripting
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-4148 info: name: Ditty 3.1.25 ...
Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting
The Ditty formerly Ditty News Ticker WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0533 info: name: Ditty formerly Ditty News Ticker 3.0.15 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The Ditty formerly...
CVE-2026-94461
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
EUVD-2026-85479
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
CVE-2026-94461 WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
CVE-2026-94461
The Ditty plugin for WordPress, affecting versions
WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Ditty versions = 3.1.69...
PT-2026-97464
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
CVE-2026-94461: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
CVE-2026-93339
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
CVE-2026-93339 Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
CVE-2026-93339
Metaphor Creations Ditty (WordPress plugin ditty-news-ticker) before 3.1.70 contains a stored XSS vulnerability in the ditty_layout_render_tag_wrapper() function. The function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation , bypassing ...
CVE-2026-93339 Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
CVE-2026-93339: Improper Neutralization of Input During Web Page Generation
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
PT-2026-96122
Name of the Vulnerable Software and Affected Versions Metaphor Creations Ditty ditty-news-ticker versions prior to 3.1.70 Description A stored cross-site scripting issue allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements. This occurs because the...
CVE-2026-81274
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81274
The WordPress Ditty (News Ticker) plugin (versions
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...