CVSS: 6.4EPSS: %CPEs: 1EXPL: 0CVE-2024-9600 – Ditty <= 3.1.46 - Authenticated (Author+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-9600
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32569 – WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-32569
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en Metaphor Creations Ditty permite almacenar XSS. Este problema afecta a Ditty: desde n/a hasta 3.1.31. The Ditty plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/ditty-news-ticker/wordpress-ditty-plugin-3-1-31-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47764 – Ditty <= 3.1.24 - Missing Authorization via save_ditty_permissions_check
https://notcve.org/view.php?id=CVE-2023-47764
The Ditty plugin for WordPress is vulnerable to unauthorized editing of dittys due to a missing capability check on the save_ditty_permissions_check function in versions up to, and including, 3.1.24. This makes it possible for unauthenticated attackers to edit dittys. • CWE-862: Missing Authorization •