Stored Cross-Site Scripting Vulnerability in Metaphor Creations Ditty Plugin

CVE-2026-93339

What is CVE-2026-93339?

The Metaphor Creations Ditty plugin prior to version 3.1.70 contains a vulnerability allowing authenticated users with Author-level privileges or higher to exploit stored cross-site scripting. This occurs by injecting arbitrary HTML elements using malicious wrapper attribute values in layout tags. The flaw arises in the ditty_layout_render_tag_wrapper() function, which directly inserts user-supplied values into HTML without performing adequate validation. Consequently, attackers can bypass standard HTML sanitization methods, leading to the execution of malicious scripts in the browsers of users who view posts or pages that include the compromised Ditty items.

References