cleantalk
Vulnerabilities and Security Researches

Ditty – Responsive News Tickers, Sliders, and Lists, CVE-2025-8085

CVE, Research URL

CVE-2025-8085

Home page URL

Security reports for Ditty – Responsive News Tickers, Sliders, and Lists

Application

Ditty – Responsive News Tickers, Sliders, and Lists

Published on
Sep 08, 2025
Research Description
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
Affected versions
max 3.1.58.
Status
vulnerable
Previous vulnerability researches
Elementor Header & Footer Builder (CVE-2025-9703) , Apr 26, 2026
Elementor Header & Footer Builder (CVE-2024-11230) , Dec 24, 2024
Elementor Header & Footer Builder (CVE-2024-10325) , Nov 09, 2024
Elementor Header & Footer Builder (CVE-2024-10050) , Oct 25, 2024
Elementor Header & Footer Builder (CVE-2025-60448) , Dec 10, 2025
New vulnerability
Contact Form 7 reCAPTCHA (CVE-2025-8280) , Apr 27, 2026
Backup Migration (CVE-2026-39480) , Apr 27, 2026
WP-BusinessDirectory – Business directory plugin for WordPress (CVE-2026-39591) , Apr 27, 2026
WP Hotel Booking (CVE-2025-8942) , Apr 27, 2026
Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling (CVE-2026-39432) , Apr 27, 2026