{"id":"CVE-2026-119492","kind":"vulnerability","aliases":["CVE-2026-119492"],"related":[],"title":"Ditty News Ticker WordPress plugin: stored script injection through 3.1.71","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71.","summary":"The Ditty news ticker plugin for WordPress fails to neutralize script-related HTML tags on a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in the browser of a visitor or administrator who views the affected page.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ditty-news-ticker","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Ditty plugin version in the WordPress admin under Plugins; affected versions are listed as `3.1.71` and earlier.","fix":"- Ditty: move to a version later than `3.1.71` (the sources do not name the fixed release)","status":"open","published_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:40+00:00","updated_at":"2026-11-07T11:48:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:40Z","model":"claude-haiku-5-5","output":{"fix":"- Ditty: move to a version later than `3.1.71` (the sources do not name the fixed release)","reach":"internet","title":"Ditty News Ticker WordPress plugin: stored script injection through 3.1.71","impact":"medium","summary":"The Ditty news ticker plugin for WordPress fails to neutralize script-related HTML tags on a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in the browser of a visitor or administrator who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ditty-news-ticker","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and whether contributor or admin rights are needed; check the NVD entry and the WordPress plugin changelog.","how_to_check":"- Check the installed Ditty plugin version in the WordPress admin under Plugins; affected versions are listed as `3.1.71` and earlier.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ditty news ticker plugin version 3.1.71 or earlier are exposed when ticker content is displayed to visitors. Sites that do not use the Ditty plugin can skip it. The sources do not say whether an account is needed to inject the script.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4233,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119492':13A,16A '-2026':12A,15A '3.1.71':10A,107C 'administr':68B 'affect':72B,102C 'allow':98C 'attack':55B 'basic':48B,86C 'browser':63B 'code':99C 'creation':91C 'cross':50B 'cross-sit':49B 'cve':11A,14A 'ditti':1A,18B,27B,93C,95C,103C 'ditty-news-tick':17B,94C 'fail':33B 'flaw':53B 'host':24B 'html':39B,80C 'improp':74C 'inject':8A,57B 'injection.this':100C 'issu':101C 'llc':92C 'metaphor':90C 'n/a':105C 'neutral':35B,75C 'news':2A,19B,28B,96C 'packag':21B 'page':44B,73B,85C 'plugin':5A,30B 'relat':38B,79C 'run':60B 'script':7A,37B,52B,58B,78C 'script-rel':36B,77C 'self':23B 'self-host':22B 'site':51B 'store':6A 'tag':40B,81C 'ticker':3A,20B,29B,97C 'view':70B 'visitor':66B 'vulner':88C 'web':43B,84C 'wordpress':4A,25B,32B 'xss':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ditty news ticker plugin version 3.1.71 or earlier are exposed when ticker content is displayed to visitors. Sites that do not use the Ditty plugin can skip it. The sources do not say whether an account is needed to inject the script.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dittynewsticker","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119492':13A,16A '-2026':12A,15A '3.1.71':10A 'cve':11A,14A 'ditti':1A 'inject':8A 'news':2A 'plugin':5A 'script':7A 'store':6A 'ticker':3A 'wordpress':4A","search_b":"'administr':68B 'affect':72B 'attack':55B 'basic':48B 'browser':63B 'cross':50B 'cross-sit':49B 'ditti':18B,27B 'ditty-news-tick':17B 'fail':33B 'flaw':53B 'host':24B 'html':39B 'inject':57B 'neutral':35B 'news':19B,28B 'packag':21B 'page':44B,73B 'plugin':30B 'relat':38B 'run':60B 'script':37B,52B,58B 'script-rel':36B 'self':23B 'self-host':22B 'site':51B 'tag':40B 'ticker':20B,29B 'view':70B 'visitor':66B 'web':43B 'wordpress':25B,32B","search_c":"'3.1.71':107C 'affect':102C 'allow':98C 'basic':86C 'code':99C 'creation':91C 'ditti':93C,95C,103C 'ditty-news-tick':94C 'html':80C 'improp':74C 'injection.this':100C 'issu':101C 'llc':92C 'metaphor':90C 'n/a':105C 'neutral':75C 'news':96C 'page':85C 'relat':79C 'script':78C 'script-rel':77C 'tag':81C 'ticker':97C 'vulner':88C 'web':84C 'xss':87C","first_public_at":"2026-11-07T11:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119492","severity":null,"published_at":"2026-11-07T11:16:58+00:00","modified_at":"2026-11-07T11:16:58+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}