CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6715 – Ditty 3.1.39-3.1.45 - Author+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-6715
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39 The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Content Title' field in versions 3.1.39 to 3.1.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was previously patched as CVE-2024-3939 and was recently reintroduced. • https://wpscan.com/vulnerability/19406acc-3441-4d4a-9163-ace8f1dceb78 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6710 – Ditty < 3.1.45 - Author+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-6710
The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tiny MCE block in all versions up to, and including, 3.1.44 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/1afcf9d4-c2f9-4d47-8d9e-d7fa6ae2358d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5575 – Ditty < 3.1.43 - Author+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-5575
The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed El complemento Ditty WordPress anterior a la versión 3.1.43 no sanitiza ni escapa a algunas de las configuraciones de sus bloques, lo que podría permitir a usuarios con altos privilegios, como autores, realizar ataques de cross-site scripting incluso cuando unfiltered_html no está permitido. The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the main text field in versions up to and including 3.1.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/65d1abb7-92e9-4cc4-a1d0-84985b484af3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •