VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Ditty – Responsive News Tickers, Sliders, and Lists security & vulnerabilities

ditty-news-ticker— active installsLast vulnerability Nov 7, 2026

No known unpatched vulnerabilities in the latest version

All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
21Known vulnerabilities
  • Critical0
  • High3
  • Medium18
  • Low0
Vulnerabilities per year
2022: 1 vulnerability1222023: 3 vulnerabilities3232024: 7 vulnerabilities7242025: 3 vulnerabilities3252026: 7 vulnerabilities726

All Ditty – Responsive News Tickers, Sliders, and Lists vulnerabilities

Ditty – Responsive News Tickers, Sliders, and Lists vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.71Update to 3.1.72
CVE-2026-119493
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤3.1.71Update to 3.1.72
CVE-2026-119492
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.69Update to 3.1.70
CVE-2026-94461
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.69Update to 3.1.70
CVE-2026-93339
Medium4.3Missing Authorization
≤3.1.67Update to 3.1.69
CVE-2026-81274
Medium5.3Missing Authorization
≤3.1.66Update to 3.1.67
CVE-2026-27355
High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
≤3.1.65Update to 3.1.66
CVE-2026-9011
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.58Update to 3.1.59
CVE-2025-60105
High7.2Unauthenticated Server-Side Request Forgery
≤3.1.57Update to 3.1.58
CVE-2025-8085
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.51Update to 3.1.52
CVE-2024-13357
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.46Update to 3.1.47
CVE-2024-9600
Medium6.43.1.45 - Authenticated (Author+) Stored Cross-Site Scripting
3.1.39 – 3.1.45Update to 3.1.46
CVE-2024-6715
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.44Update to 3.1.45
CVE-2024-6710
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.42Update to 3.1.43
CVE-2024-5575
High8.8Authenticated (Contributor+) PHP Object Injection
≤3.1.38Update to 3.1.39
CVE-2024-3954
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.35Update to 3.1.36
CVE-2024-3939
Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.31Update to 3.1.32
CVE-2024-32569
Medium5.3Missing Authorization via save_ditty_permissions_check
≤3.1.24Update to 3.1.25
CVE-2023-47764
Medium6.1Reflected Cross-Site Scripting
<3.1.25Update to 3.1.25
CVE-2023-4148
Medium6.4Authenticated (Contributor+) Stored Cross-Scripting via Shortcode
≤3.0.32Update to 3.0.33
CVE-2023-23874
Medium6.1Reflected Cross-Site Scripting
<3.0.15Update to 3.0.15
CVE-2022-0533

Ditty – Responsive News Tickers, Sliders, and Lists: common questions

Does Ditty – Responsive News Tickers, Sliders, and Lists have known vulnerabilities?

Yes. VulnCrest Radar lists 21 known vulnerabilities in Ditty – Responsive News Tickers, Sliders, and Lists: 3 high, 18 medium. None are known to affect version null.

How do I check which version of Ditty – Responsive News Tickers, Sliders, and Lists I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Ditty – Responsive News Tickers, Sliders, and Lists vulnerability?

CVE-2026-119493, published Nov 7, 2026: Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Ditty – Responsive News Tickers, Sliders, and Lists vulnerability listed in CISA KEV?

No. None of the known Ditty – Responsive News Tickers, Sliders, and Lists vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?