CVE-2026-93339

Name of the Vulnerable Software and Affected Versions Metaphor Creations Ditty (ditty-news-ticker) versions prior to 3.1.70

Description A stored cross-site scripting issue allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements. This occurs because the ditty layout render tag wrapper() function inserts wrapper attribute values directly as HTML element names without allowlist validation. This process bypasses wp kses post() sanitization, as the sanitization occurs during the save process before the layout tag attributes are resolved during rendering. Consequently, the injected payload executes in the browser of any visitor viewing posts or pages that embed the affected Ditty item.

Recommendations Update Metaphor Creations Ditty (ditty-news-ticker) to version 3.1.70 or later.