Metaphor Creations, LLC’s Ditty news ticker plugin allows legacy users to store arbitrary JavaScript in the plugin’s configuration which is later rendered in web pages without proper escaping. The vulnerability is a classic stored XSS flaw (CWE‑79) that could be used by an attacker to execute code in any user’s browser that views the ticker, potentially hijacking sessions, defacing content, or delivering malware. The impact is limited to browsers that read the affected content and does not directly compromise the server side of the WordPress site.

WordPress sites running the Ditty plugin by Metaphor Creations, version 3.1.71 and all earlier releases are vulnerable. Any site that has not upgraded past 3.1.71 may be at risk.

The CVSS score of 6.5 indicates a moderate severity, and although the EPSS score is currently unavailable, the lack of a KEV listing suggests no known exploits in the wild. The likely attack vector is through the plugin’s configuration interface where an authenticated user can insert malicious code that will be rendered for any visitor. Because the vulnerability is stored, a single compromised entry can affect all users who view the ticker. The risk is therefore moderate to high for sites that rely on this plugin and do not maintain a WAF or other content filtering.