CVE-2026-119493: WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability

Q: Which Ditty installations are affected?

The issue affects Ditty versions through 3.1.71. The available data does not identify a fixed version or any configuration prerequisites.

Q: What type of impact can exploitation have?

This is a stored cross-site scripting vulnerability. Malicious input can be retained and later rendered in a web page, causing attacker-supplied script to run in the browsers of users who view the affected content.

Published Nov 7, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Ditty plugin to a version that resolves this vulnerability.
Fixed in 3.1.72

Event History

Nov 7, 2026

CVE Published

via MITRE·10:02 AM

Data Sourced

via MITRE·10:02 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Ditty installations are affected?

The issue affects Ditty versions through 3.1.71. The available data does not identify a fixed version or any configuration prerequisites.

What type of impact can exploitation have?

This is a stored cross-site scripting vulnerability. Malicious input can be retained and later rendered in a web page, causing attacker-supplied script to run in the browsers of users who view the affected content.