CVE-2025-60105: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through = 3.1.58...

CVE-2025-8085

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

WordPress Ditty plugin < 3.1.58 - Unauthenticated SSRF vulnerability

Unauthenticated SSRF vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ditty versions 3.1.58...

CVE-2025-8085

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

CVE-2025-8085

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

CVE-2025-8085 Ditty < 3.1.58 - Unauthenticated SSRF

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

CVE-2025-8085 Ditty < 3.1.58 - Unauthenticated SSRF

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

CVE-2025-8085

The Ditty WordPress plugin (versions before 3.1.58 ) is vulnerable to a Server-Side Request Forgery (SSRF) due to a lack of authorization and authentication for requests to its displayItems endpoint. This allows unauthenticated visitors to force the server to make requests to arbitrary URLs, pote...

CVE-2025-8085: Undefined Security Weakness

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

WordPress Ditty Plugin < 3.1.58 is vulnerable to Server Side Request Forgery (SSRF)

Software Ditty Type Plugin Vulnerable versions 3.1.58 Fixed in 3.1.58 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2025-8085 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 6412178a9851 Credits Dmitrii Ignatyev Required privilege...

WordPress plugin Ditty 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-36441

Name of the Vulnerable Software and Affected Versions Ditty WordPress plugin versions prior to 3.1.58 Description The Ditty WordPress plugin before version 3.1.58 has a flaw where the displayItems endpoint does not require authorization or authentication. This allows unauthenticated visitors to...

Malicious code in test-mlw1-ditty-gavel-pikas-roups (npm)

The package test-mlw1-ditty-gavel-pikas-roups was found to contain malicious code...

MAL-2025-46283 Malicious code in test-mlw2-ditty-gavel-pikas-roups (npm)

The package test-mlw2-ditty-gavel-pikas-roups was found to contain malicious code...

Malicious code in test-mlw2-ditty-gavel-pikas-roups (npm)

The package test-mlw2-ditty-gavel-pikas-roups was found to contain malicious code...

MAL-2025-46262 Malicious code in test-mlw1-ditty-gavel-pikas-roups (npm)

The package test-mlw1-ditty-gavel-pikas-roups was found to contain malicious code...

CVE-2024-6710

The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2024-32569

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31...

CVE-2024-6715

The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/ in v3.1.39...

CVE-2024-9600

The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks...