Filtered by vendor Metaphorcreations Subscriptions
Filtered by product Ditty Subscriptions

Search

Switch to Advanced Search (Beta)
Total 17 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93339 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-10-01 5.4 Medium
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
CVE-2026-94461 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-09-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
CVE-2026-81274 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-08-27 5.3 Medium
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
CVE-2026-27355 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2023-47764 1 Metaphorcreations 1 Ditty 2026-04-29 6.5 Medium
Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.
CVE-2024-32569 1 Metaphorcreations 1 Ditty 2026-04-28 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31.
CVE-2025-60105 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-04-23 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
CVE-2025-8085 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-02-09 8.6 High
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
CVE-2024-13357 1 Metaphorcreations 1 Ditty 2025-06-10 4.8 Medium
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-3939 1 Metaphorcreations 1 Ditty 2025-05-21 5.4 Medium
The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-6715 1 Metaphorcreations 1 Ditty 2025-05-17 6.1 Medium
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39
CVE-2024-9600 1 Metaphorcreations 1 Ditty 2025-05-15 4.8 Medium
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.
CVE-2024-5575 1 Metaphorcreations 1 Ditty 2025-05-13 4.7 Medium
The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2023-4148 1 Metaphorcreations 1 Ditty 2025-05-01 6.1 Medium
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2023-23874 1 Metaphorcreations 1 Ditty 2025-01-09 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions.
CVE-2022-0533 1 Metaphorcreations 1 Ditty 2024-11-21 6.1 Medium
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
CVE-2024-6710 1 Metaphorcreations 1 Ditty 2024-09-05 5.4 Medium
The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.