Is CVE-2026-94461 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94461 being exploited in the wild.

How severe is CVE-2026-94461?

Medium severity, with a CVSS score of 6.5, published 23 September 2026.

Which products and versions are affected?

Metaphor Creations LLC Ditty News Ticker up to 3.1.69.

Is there a fix for CVE-2026-94461?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-94461 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-94461?

Check whether you run Metaphor Creations LLC Ditty News Ticker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94461: Ditty News Ticker cross-site scripting in contributor role

CVE-2026-94461 · Severity: medium · CVSS 6.5 · Published 2026-09-23

Ditty is a WordPress plugin for displaying news tickers and dynamic content on websites. A cross-site scripting vulnerability in versions 3.1.69 and earlier allows authenticated users with the contributor role to inject malicious scripts that could steal visitor data or hijack accounts. Exploitation requires the attacker to be a contributor or higher and to trick another user into clicking a malicious link or visiting a crafted page.

Technologies: Metaphor Creations LLC Ditty News Ticker. Vendors: Metaphor Creations LLC.

Quick answers

Is CVE-2026-94461 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94461 being exploited in the wild.
How severe is CVE-2026-94461?: Medium severity, with a CVSS score of 6.5, published 23 September 2026.
Which products and versions are affected?: Metaphor Creations LLC Ditty News Ticker up to 3.1.69.
Is there a fix for CVE-2026-94461?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-94461 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-94461?: Check whether you run Metaphor Creations LLC Ditty News Ticker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a contributor-level cross-site scripting (XSS) flaw in Ditty News Ticker plugin affecting versions up to 3.1.69. Successful exploitation requires user interaction and the attacker to have contributor-level privileges or higher on the WordPress installation. An attacker can inject malicious JavaScript that executes in visitors' browsers, enabling data theft or account compromise. A patch was released in version 3.1.70.

Affected products

Metaphor Creations LLC Ditty News Ticker up to 3.1.69

Timeline

2026-09-23: disclosed: CVE-2026-94461 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.