Ditty CVE-2026-94461

Exploitation requires an authenticated WordPress account with at least Contributor-level privileges on a site running Ditty <= 3.1.69 (per PR:L and the description), and it further requires a higher-privileged victim (e.g. an administrator) to view the page rendering the injected payload (UI:R). This is not exploitable pre-authentication or against a site that does not grant untrusted users Contributor accounts. What limits real-world risk: the need for a foothold/insider account, the dependence on victim interaction, and the fact that impact is confined to browser-context script execution rather than direct server compromise.

This is a genuine but modest-priority issue: a stored/authenticated Cross-Site Scripting flaw (CWE-79) in the Ditty WordPress plugin reported by Patchstack. The CVSS 6.5 (MEDIUM) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L tells a consistent story: network-reachable and low-complexity, but gated on two meaningful factors - PR:L means the attacker must already hold a low-privilege authenticated account (Contributor role, per the description title), and UI:R means a victim (typically an administrator or higher-privileged user) must load the page rendering the injected payload. The S:C (scope change) reflects that script injected by a low-privileged Contributor executes in the browser session of a different, higher-privileged user - the classic privilege-boundary crossing that justifies the elevated base score. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data is supplied. The C:L/I:L/A:L impacts appear slightly inflated: browser-context XSS realistically yields low confidentiality and integrity impact, but the A:L (availability) rating is questionable for a reflected/stored XSS with no clear availability-degradation mechanism - I would lean toward A:N (~6.4). Overall this is a real but lower-tier issue requiring an insider or a foothold account plus victim interaction, not a mass-exploitable unauthenticated RCE.

An attacker who has registered or obtained a low-privilege Contributor account on a WordPress site running Ditty <= 3.1.69 injects a malicious JavaScript payload into a Ditty field that is not properly sanitized. When an administrator later views the affected content in wp-admin, the script executes in the admin's authenticated browser session, enabling actions such as cookie/session theft or forging admin requests. No public proof-of-concept exploit is identified in the provided data.