CVE-2026-94461: WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
Published Sep 23, 2026
·Updated
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
Affected Software
1 affected component
Ditty Ditty WordPress plugin<=3.1.69
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ditty pluginto a version that resolves this vulnerability.Fixed in 3.1.70
Event History
Sep 23, 2026
CVE Published
via MITRE·06:14 PM
Data Sourced
via MITRE·06:14 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability is described as contributor XSS, so exploitation requires an attacker to have Contributor-level access to a WordPress site running an affected Ditty version.
2
Does exploitation require another user to interact with attacker-controlled content?
Yes. The CVSS vector includes user interaction required (UI:R), indicating a user must interact with the malicious content for exploitation to occur.
3
Which Ditty versions are affected?
Ditty versions 3.1.69 and earlier are identified as affected.