CVE-2026-93339Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute
Updated under an hour ago ()
Does this affect you?
It affects Metaphor Creations Ditty. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
- CVSS
- 5.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Metaphor Creations Ditty metaphor_creations:ditty (from the name) | before 3.1.70 | CNA record |
References
- https://lazytitan.ro/dittytechnical-description, exploit
- https://wordpress.org/plugins/ditty-news-ticker/#developerspatch, release-notes
- https://www.vulncheck.com/advisories/ditty-stored-xss-via-layout-tag-wrapper-attributethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.