CVE-2026-119493 · Package
NO FIX YET · SEE WHAT TO DO
The Ditty ditty-news-ticker WordPress plugin by Metaphor Creations does not neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can store content in a ticker can run script in the browser of anyone who views the page.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Ditty news ticker WordPress plugin at version 3.1.71 or earlier are exposed. The issue is stored XSS, so the risk depends on who can add or edit ticker content and whether that content is rendered to visitors. Sites that do not use the plugin can skip it.
Not affected if plugin-not-installed
Who cares ditty-news-ticker, self-hosted, wordpress
3.1.71 or earlier.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.