353 matches found
Ditty < 3.1.25 - Cross-Site Scripting
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-4148 info: name: Ditty 3.1.25 ...
Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting
The Ditty formerly Ditty News Ticker WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0533 info: name: Ditty formerly Ditty News Ticker 3.0.15 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The Ditty formerly...
WS_FTP-CVE-2023-40044
WSFTP-CVE-2023-40044 Repository with everything I have tracking the impact of WSFTP CVE-2023-40044 Includes possibly affected organizations and domains utilizing header methods. I've also built a news ticker which tracks new stories about MOVEit and WSFTP, available at...
CVE-2026-119492
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71...
CVE-2026-119492
The Metaphor Creations, LLC Ditty WordPress plugin (specifically the ditty-news-ticker component) is vulnerable to a Basic XSS vulnerability (CWE-80) due to Improper Neutralization of Script-Related HTML Tags in a web page. This flaw allows for Code Injection and affects versions from n/a through...
CVE-2026-119492 WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71...
EUVD-2026-119090
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71...
CVE-2026-119493
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71...
CVE-2026-119493 WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71...
CVE-2026-119493
The Ditty ditty-news-ticker plugin by Metaphor Creations, LLC is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 3.1.71 . An attacker could potentially execute malicious script...
EUVD-2026-119109
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71...
EUVD-2026-83942
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
CVE-2026-93339: Improper Neutralization of Input During Web Page Generation
Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...
CVE-2026-75016 Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...
CVE-2026-75016
The Magazine Blocks plugin for WordPress (versions up to and including 1.8.6 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the NewsTicker::render() method. The root cause is insufficient input sanitization and output escaping: the clientId block attribute is concatenated i...
CVE-2026-75016: Improper Neutralization of Input During Web Page Generation
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...
Stock Ticker <= 3.23.2 - Cross-Site-Scripting Detection
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajaxstocktickersymbolsearchtest function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Stock Ticker <= 3.23.2 - Cross-Site Scripting Detection
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajaxstocktickerload function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
CVE-2026-8701
The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the title-ticker-slide, title-ticker-fade, and title-ticker-typing shortcodes. This is due to insufficient input sanitization and output escaping on shortcode attributes notably border,...