Threat database

Metaphor Creations Ditty versions before 3.1.70 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with Author-level privileges or higher can inject arbitrary HTML elements via malicious wrapper attribute values in layout tags. This occurs because the function ditty_layout_render_tag_wrapper() inserts user-supplied values directly as HTML element names without allowlist validation. The sanitization function wp_kses_post() is bypassed since it runs at save time, but the malicious attributes are resolved at render time, enabling execution of the payload in visitors' browsers.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31.