Metaphor Creations Ditty (ditty‑news‑ticker) before version 3.1.70 contains a stored cross‑site scripting vulnerability. Authenticated users with Author-level privileges or higher can inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller‑supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time. This allows the payload to execute in the browser of any visitor viewing a post or page embedding the affected Ditty item, potentially leading to session hijacking, defacement, or other script‑based attacks.

The vulnerability affects installations of the Metaphor Creations Ditty plugin (ditty‑news‑ticker) on WordPress sites where the plugin version is older than 3.1.70. Any WordPress environment using the affected plugin and allowing Author-level or higher users to edit content is impacted.

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with Author-level privileges or higher injecting malicious wrapper attributes into a layout tag; the exploit requires access to content editing in the WordPress administrative interface. Because the vulnerability is applied at render time, any visitor who views the content will run the injected script, giving attackers a broad audience for exploitation, but the prerequisite of privileged content editing makes casual exploitation less likely.