CVE-2026-119493
📛 CVE Title
WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- MEDIUM
- CVSS score
- 6.5 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L- Effective score
- 6.5 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2026-10-30
- Published
- 2026-11-07 10:02 UTC
- Last updated
- 2026-11-07 18:06 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119493.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-11-07 10:17:08 UTC
- NVD last modified
- 2026-11-07 18:17:15 UTC
- NVD CVSS v3.1
- 6.5 / 10 MEDIUM source: audit@patchstack.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L- Exploitability subscore
- 2.3 / 10
- Impact subscore
- 3.7 / 10
- EPSS score
- 0.0022 (probability of exploitation in next 30 days)
- EPSS percentile
- 13.15% vs all CVEs — higher = more likely to be exploited, as of 2026-11-07
NVD / KEV / EPSS data refreshed 2026-11-08 10:04 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119109
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Metaphor Creations, LLC | Ditty |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
-
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-11-08 11:41 UTC -
web:crimsondesert.pearlabyss.com
Here are the fixes and improvements that have been added this patch . The patch is rolling out across all platforms. Please refer to the Update section below to see the state of the patch for each platform. XBOX: Patch available at a later time (in-progress) Epic Games Store: Patch available at a ...
2026-11-08 11:41 UTC -
web:cybersecuritynews.com
Node.js patched 10 vulnerabilities across versions 26.x, 24.x, and 22.x, including four high-severity flaws affecting DNS, TLS, and Brotli decompression.
2026-11-08 11:41 UTC -
web:dashboard.patch.io
Access your Patch account by logging in.
2026-11-08 11:41 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-11-08 11:41 UTC -
web:game8.co
The patch update for Phantom Blade Zero (PBZ) includes additional features and several gameplay adjustments. See all the features in the November 4 patch update for Phantom Blade Zero here!
2026-11-08 11:41 UTC -
web:sec.cloudapps.cisco.com
The right column indicates whether a release is affected by the vulnerabilities that are described in this advisory and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
2026-11-08 11:41 UTC -
web:support.esri.com
This patch deals specifically with the issues listed below under Issues addressed with this patch . As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and Uninstalling ...
2026-11-08 11:41 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-11-08 11:41 UTC -
web:www.veeam.com
CVE - 2026 -98432 is a use-after-free vulnerability in Linux kernel TCP/IPv4 connection setup (CVSS 9.8). It can lead to denial of service or memory corruption. Veeam components that include a Linux kernel are affected. Depending on the component, the patched kernel is delivered through Veeam Updater or a private fix . The following table lists the delivery for each product.
2026-11-08 11:41 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-119493.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T18:00:42.181684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T18:06:03.489Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "ditty-news-ticker",
"product": "Ditty",
"vendor": "Metaphor Creations, LLC",
"versions": [
{
"changes": [
{
"at": "3.1.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.1.71",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dzaku | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-07T10:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.<p>This issue affects Ditty: from n/a through 3.1.71.</p>"
}
],
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T10:03:35.865Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-71-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Ditty plugin to the latest available version (at least 3.1.72)."
}
],
"value": "Update the WordPress Ditty plugin to the latest available version (at least 3.1.72)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119493",
"datePublished": "2026-11-07T10:02:35.608Z",
"dateReserved": "2026-10-30T09:20:18.655Z",
"dateUpdated": "2026-11-07T18:06:03.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}