Ditty WordPress plugin CVE-2026-119493

Exploitation requires an authenticated WordPress account with at least low privileges (PR:L) sufficient to supply Ditty ticker content, plus a victim user interaction (UI:R) - a higher-privileged user must view the page where the stored payload renders - for the script to fire. The affected scope is Ditty versions from n/a through 3.1.71. The available sources do not identify the exact vulnerable field or input parameter, so the precise configuration or plugin feature required is not described in the available sources. Limiting factors that reduce real-world risk: the need for a valid authenticated foothold, the dependency on victim interaction, and the fact that impact (C:L/I:L/A:L) is limited rather than full system compromise; no evidence of active exploitation was provided.

This is a moderate-severity Stored XSS (CWE-79) in the Ditty (ditty-news-ticker) WordPress plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent and point to a real-but-not-urgent issue. The vector indicates a network-reachable flaw requiring low-privilege authentication (PR:L) plus victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context - the classic stored-XSS profile. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the absence of a CISA KEV listing and the lack of a confirmed public exploit. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted; absence of EPSS/KEV data is a gap, not evidence of safety. There is no SSVC exploitation/automatable breakdown supplied beyond the priority label. Overall this is a legitimate hygiene-priority bug for sites running the affected plugin rather than a widespread-exploitation emergency: exploitation requires an authenticated foothold and a victim viewing the malicious content, which bounds real-world impact. The single reference is a Patchstack advisory, consistent with a researcher-reported (Patchstack) finding rather than observed in-the-wild activity.

An authenticated low-privilege user (e.g., a contributor or author able to configure Ditty ticker content) injects a malicious script payload into a plugin-controlled field that is stored and later rendered without proper neutralization. When a higher-privileged user such as an administrator views the affected page, the script executes in their browser session, enabling actions like session/cookie theft or admin-context requests. No public exploit code is identified in the provided data, and successful exploitation depends on the victim loading the malicious content (UI:R).