CVE-2026-27355 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
CVE-2026-39474 | High | 8.8 | 2026-06-15 | Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. |
CVE-2026-9011 | High | 7.5 | 2026-05-22 | The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65… |
CVE-2026-2301 | Medium | 4.3 | 2026-02-25 | The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. Thi… |
CVE-2025-60105 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored X… |
CVE-2025-8085 | High | 8.6 | 2025-09-08 | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors t… |
CVE-2024-13357 | Medium | 4.8 | 2025-05-15 | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2025-24736 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-23816 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. Thi… |
CVE-2024-12472 | Medium | 4.3 | 2025-01-11 | The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() functi… |
CVE-2023-49835 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2023-47764 | Medium | 6.5 | 2024-12-09 | Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-9600 | Medium | 4.8 | 2024-11-21 | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2024-6715 | Medium | 6.1 | 2024-08-23 | The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46… |
CVE-2024-6710 | Medium | 5.4 | 2024-08-05 | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cr… |
CVE-2024-5575 | Medium | 4.7 | 2024-07-13 | The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to… |
CVE-2024-3939 | Medium | 5.4 | 2024-05-27 | The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-3954 | High | 8.8 | 2024-05-14 | The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditt… |
CVE-2023-4148 | Medium | 6.1 | 2023-09-25 | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to… |
CVE-2023-23874 | Medium | 6.5 | 2023-05-03 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions. |
CVE-2016-15027 | Low | 3.5 | 2023-02-20 | A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_pos… |
CVE-2021-33852 | Medium | 5.4 | 2022-03-10 | A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack… |
CVE-2022-0533 | Medium | 6.1 | 2022-03-07 | The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. |