Vulnerabilities and security researches forditty-news-ticker ditty-news-ticker
Direction: ascendingJun 07, 2024
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2023-23874
- CVE, Research URL
- Date
- May 03, 2023
- Research Description
- Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions.
- Affected versions
-
max 3.0.33.
- Status
-
vulnerable
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2023-4148
- CVE, Research URL
- Date
- Sep 25, 2023
- Research Description
- The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Affected versions
-
max 3.1.25.
- Status
-
vulnerable
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-32569
- CVE, Research URL
- Date
- Apr 18, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31.
- Affected versions
-
max 3.1.32.
- Status
-
vulnerable
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2022-0533
- CVE, Research URL
- Date
- Mar 07, 2022
- Research Description
- The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
- Affected versions
-
max 3.0.15.
- Status
-
vulnerable
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-3954
- CVE, Research URL
- Date
- May 14, 2024
- Research Description
- The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Affected versions
-
max 3.1.39.
- Status
-
vulnerable
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-3939
- CVE, Research URL
- Date
- May 27, 2024
- Research Description
- The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected versions
-
max 3.1.36.
- Status
-
vulnerable
Jun 10, 2024
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2023-47764
- CVE, Research URL
- Date
- Dec 09, 2024
- Research Description
- Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.
- Affected versions
-
max 3.1.25.
- Status
-
vulnerable
Jul 13, 2024
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-5575
- CVE, Research URL
- Date
- Jul 13, 2024
- Research Description
- The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Affected versions
-
max 3.1.43.
- Status
-
vulnerable
Aug 07, 2024
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-6710
- CVE, Research URL
- Date
- Aug 05, 2024
- Research Description
- The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Affected versions
-
max 3.1.45.
- Status
-
vulnerable
Aug 25, 2024
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-6715
- CVE, Research URL
- Date
- Aug 23, 2024
- Research Description
- The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39
- Affected versions
-
max 3.1.46.
- Status
-
vulnerable
Nov 17, 2024
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-9600
- CVE, Research URL
- Date
- Nov 21, 2024
- Research Description
- The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.
- Affected versions
-
max 3.1.47.
- Status
-
vulnerable
May 13, 2025
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2024-13357
- CVE, Research URL
- Date
- May 16, 2025
- Research Description
- The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
max 3.1.52.
- Status
-
vulnerable
Oct 11, 2025
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2025-60105
- CVE, Research URL
- Date
- Sep 26, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
- Affected versions
-
max 3.1.59.
- Status
-
vulnerable
Apr 27, 2026
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2025-8085
- CVE, Research URL
- Date
- Sep 08, 2025
- Research Description
- The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Affected versions
-
max 3.1.58.
- Status
-
vulnerable
May 24, 2026
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2026-9011
- CVE, Research URL
- Date
- May 22, 2026
- Research Description
- The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.
- Affected versions
-
max 3.1.66.
- Status
-
vulnerable
Jul 29, 2026
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2026-27355
- CVE, Research URL
- Date
- Jul 23, 2026
- Research Description
- Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
- Affected versions
-
max 3.1.67.
- Status
-
vulnerable
Aug 29, 2026
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2026-81274
- CVE, Research URL
- Date
- Aug 27, 2026
- Research Description
- Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
- Affected versions
-
max 3.1.69.
- Status
-
vulnerable
Sep 22, 2026
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2026-93339
- CVE, Research URL
- Date
- Sep 21, 2026
- Research Description
- Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
- Affected versions
-
max 3.1.70.
- Status
-
vulnerable
Nov 10, 2026
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2026-119492
- CVE, Research URL
- Date
- Nov 07, 2026
- Research Description
- Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71.
- Affected versions
-
max 3.1.72.
- Status
-
vulnerable
Ditty – Responsive News Tickers, Sliders, and Lists # CVE-2026-119493
- CVE, Research URL
- Date
- Nov 07, 2026
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.
- Affected versions
-
max 3.1.72.
- Status
-
vulnerable