TI-2026-62931 Aliases CVE-2026-93339 GHSA-3vrp-5rc4-9852

Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

LOW 23CWE-79Published 2026-09-21 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00313 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Ditty (Metaphor Creations): 3.1.70

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
metaphorcreations	Ditty	before 3.1.70	3.1.70	Patch available	CNA

Ditty Vendormetaphorcreations Affected before 3.1.70 Fixed in 3.1.70 Patch available CNA

Remediation

Fix · CNA Ditty (Metaphor Creations) Fixed in 3.1.70

Timeline

2026-10-02 Threatist record created from CVE-2026-93339
2026-10-03 Alias added: GHSA-3vrp-5rc4-9852

References

Exploit 1

Researcher Disclosure

Patch 1

WordPress Changelog

TI-2025-07398 Ditty < 3.1.58 - Unauthenticated SSRF CVSS 3.1HIGH 8.6
TI-2024-06224 Ditty 3.1.39-3.1.45 - Author+ Stored XSS CVSS 3.1MEDIUM 6.1
TI-2023-03837 Ditty < 3.1.25 - Reflected XSS CVSS 3.1MEDIUM 6.1
TI-2024-06219 Ditty < 3.1.45 - Author+ Stored XSS CVSS 3.1MEDIUM 5.4
TI-2024-12399 Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-08907 Ditty < 3.1.47 - Author+ Stored XSS CVSS 3.1MEDIUM 4.8

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences