Cross-Site Scripting Vulnerability in Ditty News Ticker by Metaphor Creations, LLC
CVE-2026-119493

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Ditty
Vendor
CVE Published:
7 November 2026

What is CVE-2026-119493?

The Ditty News Ticker, developed by Metaphor Creations, LLC, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability, which arises from improper input neutralization during web page generation. This vulnerability permits an attacker to inject malicious scripts into the application, leading to the potential compromise of user data and session hijacking. The issue affects all versions of Ditty News Ticker up to and including 3.1.71, making it imperative for users to apply necessary patches and enhance input validation mechanisms to mitigate risks.

Affected Version(s)

Ditty 0 <= 3.1.71

References

https://patchstack.com/database/wordpress/plugin/ditty-ne...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku | Patchstack Bug Bounty Program
.