Metaphor Creations, LLC vulnerabilities and threats

CVE-2026-119492 is a medium severity vulnerability in Metaphor Creations, LLC Ditty plugin (ditty-news-ticker) that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) issue. The vulnerability affects versions from initial releases up to 3.1.71. It has been fixed in version 3.1.72.

CVE-2026-119493 is a stored cross-site scripting (XSS) vulnerability in Ditty by Metaphor Creations, LLC. It affects versions from initial releases up to 3.1.71. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 3.1.72.