19 matches found
CVE-2024-6710
The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
CVE-2024-6715
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/ in v3.1.39...
CVE-2024-9600
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks...
CVE-2024-13357
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-13357
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-13357 Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-9600
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks...
CVE-2024-9600
The Ditty WordPress plugin versions prior to 3.1.47 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the plugin's failure to properly sanitise and escape some of its settings. This flaw allows users with high privileges, such as authors , to perform XSS attacks. To ...
CVE-2024-9600 Ditty < 3.1.47 - Author+ Stored XSS
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks...
CVE-2024-6715 Ditty 3.1.39-3.1.45 - Author+ Stored XSS
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/ in v3.1.39...
PT-2024-37818 · WordPress · Ditty
Name of the Vulnerable Software and Affected Versions: The Ditty WordPress plugin versions prior to 3.1.46 Description: The issue is related to a previously fixed security problem that was re-introduced in version 3.1.39 of the plugin. No information is provided about the estimated number of...
CVE-2024-6710
The CVE-2024-6710 issue affects the Ditty WordPress plugin prior to version 3.1.45. It stems from inadequate sanitisation/escaping of certain parameters, enabling attackers with as little as Contributor-level access to perform Cross-Site Scripting (XSS) attacks. Red Hat’s advisory reiterates the ...
CVE-2024-5575
The Ditty WordPress plugin versions prior to 3.1.43 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to properly sanitise and escape some of the plugin's block settings. This allows high-privilege users, such as authors , to perform XSS attacks even ...
CVE-2024-3939
The Ditty WordPress plugin, in versions prior to 3.1.36 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administrators , to perform XSS attacks, even in env...
CVE-2023-4148
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-4148
CVE-2023-4148 affects the Ditty WordPress plugin prior to 3.1.25. The issue is a lack of proper sanitisation/escaping of certain parameters and generated URLs, leading to a Reflected XSS that could target high-privilege users (e.g., admins). Evidence in connected docs confirms the vulnerability a...
CVE-2023-4148 Ditty < 3.1.25 - Reflected XSS
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-4148: Improper Neutralization of Input During Web Page Generation
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...