CVE-2026-119492: WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability

Q: Which installations are affected?

The issue affects the Ditty WordPress plugin through version 3.1.71. The available data does not identify an unaffected fixed version.

Q: What weakness is involved?

The vulnerability is described as improper neutralization of script-related HTML tags in a web page, resulting in basic cross-site scripting and code injection.

Published Nov 7, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Code Injection.This issue affects Ditty: from n/a through 3.1.71.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Ditty plugin to a version that resolves this vulnerability.
Fixed in 3.1.72

Event History

Nov 7, 2026

CVE Published

via MITRE·10:17 AM

Data Sourced

via MITRE·10:17 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects the Ditty WordPress plugin through version 3.1.71. The available data does not identify an unaffected fixed version.

What weakness is involved?

The vulnerability is described as improper neutralization of script-related HTML tags in a web page, resulting in basic cross-site scripting and code injection.