Executive brief
Ditty is a WordPress plugin used to display dynamic content like news tickers and sliders. The plugin allows authenticated users with Author-level access or higher to inject malicious code that executes when any visitor views pages containing the compromised content. An attacker can steal session cookies, deface pages, or perform actions as the admin by injecting arbitrary JavaScript into wrapper attributes.
Technical details
Stored XSS in the ditty_layout_render_tag_wrapper() function in includes/layout-tag-helpers.php allows Author+ users to inject arbitrary HTML element names via wrapper attributes without validation. The vulnerability exists because wp_kses_post() sanitization runs before layout tag attributes are parsed at render time, allowing plaintext JavaScript payloads to bypass filtering and be executed as script tags in visitor browsers. No patch is available; versions before 3.1.70 are affected.
Affected products
- Metaphor Creations Ditty before 3.1.70
Timeline
- 2026-09-21: disclosed
- 2026-09-25: advisory