XSS Vulnerability in Ditty News Ticker by Metaphor Creations, LLC
CVE-2026-119492

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Ditty
Vendor
CVE Published:
7 November 2026

What is CVE-2026-119492?

The Ditty News Ticker by Metaphor Creations, LLC is affected by an XSS vulnerability that allows unauthorized script injection. This flaw results from the improper neutralization of script-related HTML tags, posing a risk for users loading affected versions of the plugin. An attacker could exploit this vulnerability to inject malicious scripts into web pages, leading to potential data theft or website compromise.

Affected Version(s)

Ditty 0 <= 3.1.71

References

https://patchstack.com/database/wordpress/plugin/ditty-ne...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku | Patchstack Bug Bounty Program
.