WordPress Plugin Vulnerabilities

Ditty < 3.0.33 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
ditty-news-ticker
Fixed in 3.0.33

References

CVE
CVE-2023-23874

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Verified
No
WPVDB ID
d6f2abdb-a9b2-472d-98df-9e064c4c0da4

Timeline

Publicly Published
2023-02-20 (about 3 years ago)
Added
2023-05-04 (about 2 years ago)
Last Updated
2023-05-04 (about 2 years ago)

Other

Published
Title
Published
2025-12-04
Title
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-03-28
Title
Stackable < 3.12.12 - Contributor+ Stored XSS via Posts Block
Published
2021-10-13
Title
Brizy < 2.3.12 - Authenticated Stored Cross-Site Scripting
Published
2023-07-24
Title
Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS
Published
2024-03-25
Title
WPFront Notification Bar < 3.4 - Authenticated (Editor+) Stored Cross-Site Scripting