CVE-2026-27355

Cross Site Scripting (XSS) vulnerability in the Ditty plugin in versions up to and including 3.1.69. The vulnerability can be exploited by a user with Contributor privileges.

Ditty before version 3.1.70 has a stored XSS vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The rendering function inserts these values without allowlist validation, bypassing wp_kses_post() sanitization.

The Ditty plugin version 3.1.67 and earlier has a Subscriber Broken Access Control vulnerability. A user with the subscriber role can gain unauthorized access to functions they should not have permissions for.

Vulnerability in the Ditty plugin for WordPress up to version 3.1.65 – missing authorization check in the ditty_init AJAX endpoint allows unauthenticated attackers to retrieve content of non-public Dittys (including drafts, pending, scheduled, and disabled entries) by enumerating post IDs.

The Ditty plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.1.58.