Metaphorcreations
Metaphorcreations Ditty: vulnerabilidades y CVE
Metaphorcreations Ditty tiene 19 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE19
Últimos 12 meses5
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-94461 | Media (6.5) | 0.17% | — | 23 sept 2026 | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
| CVE-2026-93339 | Media (5.1) | 0.31% | — | 21 sept 2026 | Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by… |
| CVE-2026-81274 | Media (5.3) | 0.29% | — | 27 ago 2026 | Subscriber Broken Access Control in Ditty <= 3.1.67 versions. |
| CVE-2026-27355 | Media (5.3) | 0.38% | — | 23 jul 2026 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
| CVE-2026-9011 | Alta (7.5) | 0.59% | — | 22 may 2026 | The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a… |
| CVE-2025-60105 | Media (6.5) | 0.20% | — | 26 sept 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58. |
| CVE-2025-8085 | Alta (8.6) | 18% | — | 8 sept 2025 | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. |
| CVE-2024-13357 | Media (4.8) | 0.31% | — | 15 may 2025 | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2023-47764 | Media (6.5) | 0.44% | — | 9 dic 2024 | Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24. |
| CVE-2024-9600 | Media (4.8) | 0.38% | — | 21 nov 2024 | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks. |
| CVE-2024-6715 | Media (6.1) | 0.35% | — | 23 ago 2024 | The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39 |
| CVE-2024-6710 | Media (5.4) | 0.35% | — | 5 ago 2024 | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. |
| CVE-2024-5575 | Media (4.7) | 0.43% | — | 13 jul 2024 | The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when… |
| CVE-2024-3939 | Media (5.4) | 0.40% | — | 27 may 2024 | The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2024-3954 | Alta (8.8) | 0.66% | — | 14 may 2024 | The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with… |
| CVE-2024-32569 | Media (6.5) | 0.34% | — | 18 abr 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31. |
| CVE-2023-4148 | Media (6.1) | 0.84% | — | 25 sept 2023 | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against… |
| CVE-2023-23874 | Media (5.4) | 0.39% | — | 3 may 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions. |
| CVE-2022-0533 | Media (6.1) | 1.8% | — | 7 mar 2022 | The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.