rootpwn

medium · CVSS v3 5.4 · CVSS v4 5.1

CVE-2026-93339

Metaphor Creations Ditty plugin before 3.1.70 contains a stored XSS that allows authenticated users with Author-level privileges to inject a

Overview

Metaphor Creations Ditty plugin before 3.1.70 contains a stored XSS that allows authenticated users with Author-level privileges to inject arbitrary HTML elements via wrapper attributes. This flaw can cause malicious scripts to execute in the browsers of any visitor who views a post or page containing the affected Ditty item. The vulnerability arises because wrapper attribute values are inserted as element names without validation, bypassing sanitization.

Description

Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.

Impact

Confidentiality: malicious scripts can exfiltrate data. Integrity: attacker can modify page content. Availability: not directly impacted. Defenders: site administrators, content authors, and site visitors are affected.

Remediation

Upgrade to Ditty 3.1.70 or later. If upgrade is not possible, restrict Author-level users or disable the layout tag wrapper feature. Apply a content security policy that blocks inline scripts. Monitor for unexpected script execution.

Risk context

Medium severity; no EPSS data available. Defenders should address promptly to prevent XSS exploitation.

Affected products

  • Metaphor Creations Ditty
  • Ditty News Ticker
  • WordPress plugin Ditty

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
5.4
CVSS v4
5.1
EPSS
—

XSS WordPress Stored XSS MetaphorCreations Ditty Content Injection

← All CVEs

Related CVEs

medium

CVE-2026-94094

OpenClaw up to 2026.9.5 has a denial‑of‑service flaw in the Canvas Host Route that allows remote attackers to crash the server by sending a crafted request that forces the entire file to be buffered. The vulnerability can cause the OpenClaw service to become unresponsive, impacting availability for users and administrators.

View analysis

medium

CVE-2026-94102

WuzhiCMS versions up to 4.1.0 allow an attacker to trigger an open redirect via the Login component by manipulating the forward argument in /index.php?m=member&v=Login. The flaw can be exploited remotely without authentication and may be used to redirect users to malicious sites.

View analysis

medium

CVE-2026-94103

A code injection flaw exists in RooCMS’s eval function within site_pagePHP.php, allowing remote attackers to execute arbitrary code. The vulnerability affects versions up to 1.2.2, 1.3.4, and 1.4RC2. It can be exploited without authentication, posing a medium risk to affected sites.

View analysis

medium

CVE-2026-94032

A SQL injection vulnerability exists in itsourcecode Leave Management System 1.0, specifically in /module/department/index.php. Attackers can manipulate the ID parameter to inject arbitrary SQL, enabling remote data exfiltration or modification. The flaw is publicly documented and can be exploited without authentication.

View analysis