CVE-2026-93339
Received Received - Intake

Stored XSS in Metaphor Creations Ditty WordPress Plugin

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-93339
EUVD
EUVD-2026-83942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
metaphor_creations ditty to 3.1.70 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Ditty WordPress plugin versions before 3.1.70. It allows authenticated users with Author-level privileges or higher to inject malicious HTML elements by supplying crafted wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts these attributes directly as HTML element names without validation, bypassing wp_kses_post() sanitization which occurs at save time but not at render time. This causes the injected payload to execute in the browsers of visitors viewing posts or pages that include the affected Ditty item.

Detection Guidance

To detect this vulnerability, check the version of the Ditty plugin installed on your WordPress site. If the version is below 3.1.70, the system is vulnerable. You can verify the version by inspecting the plugin files or using WordPress admin panel under Plugins.

Impact Analysis

The vulnerability allows attackers with Author-level access or higher to inject malicious scripts into web pages. When visitors view these pages, the injected scripts can execute in their browsers, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on their behalf. This could lead to account takeovers, data theft, or defacement of the website.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. If exploited, it could result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Immediately update the Ditty plugin to version 3.1.70 or later. This version includes security fixes that restrict layout tag wrappers to safe HTML elements and enforce proper capabilities for actions. Remove or disable the plugin if an update is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93339. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart