Ditty News Ticker CVE-2026-93339

Requires an authenticated account with Author-level privileges or higher on the target WordPress site (PR:L), so exploitation is gated by the site's user-registration and role-assignment policy - highest risk on sites granting Author/Editor access to untrusted or many contributors. The stored payload only fires when a visitor loads a post or page that embeds the affected Ditty item (UI:P), and the injection must be placed in a wrapper attribute value of a layout tag that ditty_layout_render_tag_wrapper() emits as an HTML element name. The affected versions are Ditty (ditty-news-ticker) before 3.1.70; the plugin must be installed, active, and used to render Ditty items on public-facing pages.

This is a moderate-severity stored XSS in the Ditty (ditty-news-ticker) WordPress plugin, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, 5.1) shows network reach and low complexity but requires authenticated Author-level privileges (PR:L) plus victim interaction (UI:P), which correctly caps this below critical. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not a drop-everything emergency. The real value is a low-to-mid priority patch item: the trust boundary is that any Author (a role often granted to contributors/guest writers) can persist a payload that fires for every anonymous visitor, and the subtle bypass (KSES sanitizes at save time, but layout tag wrapper attributes are resolved at render time via ditty_layout_render_tag_wrapper()) means standard wp_kses_post() defenses are silently ineffective. Prioritize patching on sites with untrusted or multi-author editorial workflows; deprioritize where only trusted administrators author content.

An attacker holding an Author-level account (self-registered on open-registration sites, a compromised contributor, or a rogue guest writer) edits a Ditty item and supplies a malicious wrapper attribute value in a layout tag so that an attacker-controlled string is emitted as an HTML element name. Because wp_kses_post() runs at save time before the layout tag attributes are resolved at render time, the payload survives sanitization and executes in the browser of any visitor viewing a post or page that embeds the affected Ditty item. No public POC is referenced in the provided data.