Skip to content
OpenAdvisories

Product · Metaphor Creations

Ditty

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-119492

    WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2026-119493

    WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2026-94461

    WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

    Metaphor Creations Ditty
  • Medium 5.4
    CVE-2026-93339

    Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

    Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute v…

    Metaphor Creations Ditty
  • Medium 5.3
    CVE-2026-81274

    WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

    Metaphor Creations Ditty
  • Medium 5.3
    CVE-2026-27355

    WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2025-60105

    WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2023-47764

    WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability

    Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2024-32569

    WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2023-23874

    WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions.

    Metaphor Creations Ditty