Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Display Settings
- ID
- WPSEC-2026-0265
- Plugin
- Ditty – Responsive News Tickers, Sliders, and Lists (ditty-news-ticker)
- Affected
- from 3.0.1 before 3.1.71
- Remediation
- Update to 3.1.71 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Ditty – Responsive News Tickers, Sliders, and Lists on WPSec AttackSurface
- Fix released
- Published
Description
The Ditty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_settings' attribute of the [ditty] shortcode and the 'displaySettings' attribute of the Ditty block in versions 3.0.1 up to, and including, 3.1.70. This is due to the custom display settings being merged into the display arguments without sanitization, which lets protected keys such as 'title' and 'items', and other settings, be overridden with values that the ticker and list display scripts insert into the page as HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0265/
- https://plugins.svn.wordpress.org/ditty-news-ticker/tags/3.1.71/
- https://wordpress.org/plugins/ditty-news-ticker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS