Skip to content
Noroxi

Ditty – Responsive News Tickers, Sliders, and Lists

ditty-news-ticker · plugin

Known security vulnerabilities for Ditty – Responsive News Tickers, Sliders, and Lists. Find out in seconds which version runs on your site with WP Lens.

11 known vulnerabilities

4 exploitable without logging in · 1 with public exploit code · latest Sep 23, 2026

Listed on wordpress.org · latest 3.1.71 · last updated Sep 23, 2026 · 30K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-3954contributor+≤ 3.1.38

    Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection

    High 8.8

  • CVE-2026-9011unauthenticated≤ 3.1.65

    Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action

    High 7.5

  • CVE-2023-47764unauthenticated≤ 3.1.24

    WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2025-60105login required≤ 3.1.58

    WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2024-32569login required≤ 3.1.31

    WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-94461contributor+≤ 3.1.69

    WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2022-0533unauthenticated · needs a click→ 3.0.15

    Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-23874contributor+≤ 3.0.32

    WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2026-27355unauthenticated≤ 3.1.66

    WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2026-81274subscriber+≤ 3.1.67

    WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2026-93339author+→ 3.1.70

    Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

    Medium 5.1

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory