Ditty (Unknown) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-09-08. Vendor: Unknown.

CVEs of Ditty

• CVE-2025-8085 - CVSS 8.6 (high), 2025-09-08: The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors…
• CVE-2024-13357 - CVSS 4.8 (medium), 2025-05-15: The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform…
• CVE-2024-9600 - CVSS 4.8 (medium), 2024-11-21: The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform…
• CVE-2024-6715 - CVSS 6.1 (medium), 2024-08-23: The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue…
• CVE-2024-6710 - CVSS 5.4 (medium), 2024-08-05: The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform…
• CVE-2024-5575 - CVSS 4.7 (medium), 2024-07-13: The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to…
• CVE-2024-3939 - CVSS 5.4 (medium), 2024-05-27: The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
• CVE-2023-4148 - CVSS 6.1 (medium), 2023-09-25: The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to…