The vulnerability is a stored Cross‑Site Scripting flaw that results from the Ditty plugin’s failure to properly neutralize user‑supplied input before rendering it in web pages. A successful exploitation allows an attacker to inject arbitrary JavaScript code that will be executed in the browsers of all visitors who load the affected page, potentially enabling session hijacking, data theft, or defacement. This weakness corresponds to CWE‑79.

The issue affects the WordPress Ditty news ticker plugin from Metaphor Creations, for all releases up to and including version 3.1.58. Any site using this plugin or an earlier revision is potentially vulnerable.

With a CVSS score of 6.5, the vulnerability is considered moderately severe. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and it is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated or unauthenticated user submitting malicious input through the plugin’s interface, which is then stored and rendered as part of the ticker output. Once the payload is in place, all visitors to the affected pages can be impacted.