CVE-2026-93339: Improper Neutralization of Input During Web Page Generation

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...

CVE-2023-47764: Missing Authorization

Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through = 3.1.24...