Skip to content
fr Sign in
6.1 Medium

CVE-2023-4148 The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before…

Description

The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected products and versions

Product Affected versions Fixed in
Ditty 3.1 earliest → < 3.1.25 3.1.25

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Ditty

The 8 CVEs of Ditty →
CVE-2025-8085 The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems… 8.6 High CVE-2024-13357 The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high… 4.8 Medium CVE-2024-9600 The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high… 4.8 Medium CVE-2024-6715 The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue… 6.1 Medium
Track this CVE