What’s Vulnerable › Vulnerabilities

CVE-2022-0533: Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-07 · updated 2026-06-17
• Weakness: CWE-79

Description

The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.

Affected products

• Ditty: before 3.0.15 — fixed in 3.0.15

How to fix

Upgrade to a fixed version: Ditty 3.0.15. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker
• https://wpscan.com/vulnerability/40f36692-c898-4441-ad24-2dc17856bd74
• https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker
• https://wpscan.com/vulnerability/40f36692-c898-4441-ad24-2dc17856bd74

Get alerted when CVE-2022-0533 or the next vulnerability affects your stack