Ditty – Responsive News Tickers, Sliders, and Lists vulnerabilities

2 known vulnerabilities in Ditty – Responsive News Tickers, Sliders, and Lists from Metaphorcreations. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Ditty – Responsive News Tickers, Sliders, and…: Missing Authorization

  CVE-2026-9011May 22, 2026Metaphorcreations

  The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. Th

• 8.8 High severity

  Ditty – Responsive News Tickers, Sliders, and…: Deserialization of Untrusted Data

  CVE-2024-3954May 14, 2024Metaphorcreations

  The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with contributor-level access and above, to in