{"id":"CVE-2026-119493","kind":"vulnerability","aliases":["CVE-2026-119493"],"related":[],"title":"Ditty news ticker WordPress plugin: stored XSS through 3.1.71","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.","summary":"The Ditty ditty-news-ticker WordPress plugin by Metaphor Creations does not neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can store content in a ticker can run script in the browser of anyone who views the page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ditty-news-ticker","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Ditty News Ticker (ditty-news-ticker) plugin in the WordPress admin under Plugins.\n- Confirm whether the installed version is `3.1.71` or earlier.","fix":"- Ditty News Ticker (ditty-news-ticker): unknown; the sources give no fixed version.","status":"open","published_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:32+00:00","updated_at":"2026-11-07T10:48:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T10:48:32Z","model":"claude-haiku-5-5","output":{"fix":"- Ditty News Ticker (ditty-news-ticker): unknown; the sources give no fixed version.","reach":"internet","title":"Ditty news ticker WordPress plugin: stored XSS through 3.1.71","impact":"medium","summary":"The Ditty ditty-news-ticker WordPress plugin by Metaphor Creations does not neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can store content in a ticker can run script in the browser of anyone who views the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ditty-news-ticker","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers on the site","analyst_note":"Check the NVD entry and the plugin's changelog or WordPress.org page for a fixed version and the privilege needed to inject content.","how_to_check":"- Check the installed version of the Ditty News Ticker (ditty-news-ticker) plugin in the WordPress admin under Plugins.\n- Confirm whether the installed version is `3.1.71` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ditty news ticker WordPress plugin at version 3.1.71 or earlier are exposed. The issue is stored XSS, so the risk depends on who can add or edit ticker content and whether that content is rendered to visitors. Sites that do not use the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4224,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119493':12A,15A '-2026':11A,14A '3.1.71':9A,101C 'affect':96C 'allow':92C 'anyon':65B 'attack':50B 'browser':63B 'content':54B 'creation':35B,85C 'cross':46B,79C 'cross-sit':45B,78C 'cve':10A,13A 'ditti':1A,17B,26B,28B,87C,89C,97C 'ditty-news-tick':16B,27B,88C 'enabl':43B 'generat':41B,77C 'host':23B 'improp':70C 'input':39B,73C 'issu':95C 'llc':86C 'metaphor':34B,84C 'n/a':99C 'neutral':38B,71C 'news':2A,18B,29B,90C 'packag':20B 'page':42B,69B,76C 'plugin':5A,32B 'run':59B 'script':48B,60B,81C 'self':22B 'self-host':21B 'site':47B,80C 'store':6A,44B,53B,93C 'ticker':3A,19B,30B,57B,91C 'view':67B 'vulner':82C 'web':75C 'wordpress':4A,24B,31B 'xss':7A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ditty news ticker WordPress plugin at version 3.1.71 or earlier are exposed. The issue is stored XSS, so the risk depends on who can add or edit ticker content and whether that content is rendered to visitors. Sites that do not use the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dittynewsticker","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119493':12A,15A '-2026':11A,14A '3.1.71':9A 'cve':10A,13A 'ditti':1A 'news':2A 'plugin':5A 'store':6A 'ticker':3A 'wordpress':4A 'xss':7A","search_b":"'anyon':65B 'attack':50B 'browser':63B 'content':54B 'creation':35B 'cross':46B 'cross-sit':45B 'ditti':17B,26B,28B 'ditty-news-tick':16B,27B 'enabl':43B 'generat':41B 'host':23B 'input':39B 'metaphor':34B 'neutral':38B 'news':18B,29B 'packag':20B 'page':42B,69B 'plugin':32B 'run':59B 'script':48B,60B 'self':22B 'self-host':21B 'site':47B 'store':44B,53B 'ticker':19B,30B,57B 'view':67B 'wordpress':24B,31B","search_c":"'3.1.71':101C 'affect':96C 'allow':92C 'creation':85C 'cross':79C 'cross-sit':78C 'ditti':87C,89C,97C 'ditty-news-tick':88C 'generat':77C 'improp':70C 'input':73C 'issu':95C 'llc':86C 'metaphor':84C 'n/a':99C 'neutral':71C 'news':90C 'page':76C 'script':81C 'site':80C 'store':93C 'ticker':91C 'vulner':82C 'web':75C 'xss.this':94C","first_public_at":"2026-11-07T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119493","severity":null,"published_at":"2026-11-07T10:17:08+00:00","modified_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}