WordPress plugin
Ditty – Responsive News Tickers, Sliders, and Lists security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium18
- Low0
All Ditty – Responsive News Tickers, Sliders, and Lists vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action ≤3.1.65Update to 3.1.66 | CVE-2026-9011 | |
| High7.2 | Unauthenticated Server-Side Request Forgery ≤3.1.57Update to 3.1.58 | CVE-2025-8085 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection ≤3.1.38Update to 3.1.39 | CVE-2024-3954 |
- High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
≤3.1.65Update to 3.1.66
- High7.2Unauthenticated Server-Side Request Forgery
≤3.1.57Update to 3.1.58
- High8.8Authenticated (Contributor+) PHP Object Injection
≤3.1.38Update to 3.1.39
Ditty – Responsive News Tickers, Sliders, and Lists: common questions
Does Ditty – Responsive News Tickers, Sliders, and Lists have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in Ditty – Responsive News Tickers, Sliders, and Lists: 3 high, 18 medium. None are known to affect version null.
How do I check which version of Ditty – Responsive News Tickers, Sliders, and Lists I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Ditty – Responsive News Tickers, Sliders, and Lists vulnerability?
CVE-2026-119493, published Nov 7, 2026: Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Ditty – Responsive News Tickers, Sliders, and Lists vulnerability listed in CISA KEV?
No. None of the known Ditty – Responsive News Tickers, Sliders, and Lists vulnerabilities is currently listed in the CISA KEV catalog.