Ditty vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest Ditty vulnerabilities

CVE-2026-94461 — WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2026-93339 — Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute (CVSS 5.4)
CVE-2026-81274 — WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2026-27355 — WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2025-60105 — WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
CVE-2025-8085 — Ditty < 3.1.58 - Unauthenticated SSRF (CVSS 8.6)
CVE-2024-13357 — Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS (CVSS 4.8)
CVE-2023-47764 — WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability (CVSS 6.5)
CVE-2024-9600 — Ditty < 3.1.47 - Author+ Stored XSS (CVSS 4.8)
CVE-2024-6715 — Ditty 3.1.39-3.1.45 - Author+ Stored XSS (CVSS 6.1)
CVE-2024-6710 — Ditty < 3.1.45 - Author+ Stored XSS (CVSS 5.4)
CVE-2024-5575 — Ditty < 3.1.43 - Author+ Stored XSS (CVSS 4.7)
CVE-2024-3939 — Ditty < 3.1.36 - Author+ Stored XSS (CVSS 5.4)
CVE-2024-32569 — WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2023-4148 — Ditty < 3.1.25 - Reflected XSS (CVSS 6.1)
CVE-2023-23874 — WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
CVE-2022-0533 — Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS) (CVSS 6.1)