4.7
Medium
CVE-2024-5575 The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow…
Description
The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected products and versions
Other CVEs of Ditty
The 10 CVEs of Ditty →
CVE-2026-94461
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions
6.5
Medium
CVE-2026-81274
Subscriber Broken Access Control in Ditty <= 3.1.67 versions
5.3
Medium
CVE-2026-27355
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions
5.3
Medium
CVE-2025-60105
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in…
6.5
Medium