CVE-2025-60105
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Ditty plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.1.58.
Risk Assessment
An attacker can inject malicious scripts that are stored and executed in a user's browser when they visit the affected page, potentially leading to session theft or account takeover.
Recommendation
Update the Ditty plugin to a version newer than 3.1.58 that includes the fix for this vulnerability.
Other vulnerabilities in Ditty
See all- CVE-2026-27355Medium
The Ditty plugin for WordPress versions 3.1.66 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-94461Medium
Cross Site Scripting (XSS) vulnerability in the Ditty plugin in versions up to and including 3.1.69. The vulnerability can be exploited by a user with Contributor privileges.
- CVE-2026-93339Medium
Ditty before version 3.1.70 has a stored XSS vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The rendering function inserts these values without allowlist validation, bypassing wp_kses_post() sanitization.
- CVE-2026-81274Medium
The Ditty plugin version 3.1.67 and earlier has a Subscriber Broken Access Control vulnerability. A user with the subscriber role can gain unauthorized access to functions they should not have permissions for.
- CVE-2026-9011High
Vulnerability in the Ditty plugin for WordPress up to version 3.1.65 – missing authorization check in the ditty_init AJAX endpoint allows unauthenticated attackers to retrieve content of non-public Dittys (including drafts, pending, scheduled, and disabled entries) by enumerating post IDs.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS