Threat database

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

CVE-2026-81274 is a medium severity vulnerability in metaphorcreations Ditty versions up to and including 3.1.67. It involves missing authorization controls, specifically a broken access control issue classified under CWE-862. This flaw allows unauthorized users to perform actions that should require proper authorization, potentially leading to integrity impacts. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

The Post Duplicator WordPress plugin up to version 3.0.11 has a missing authorization vulnerability. The duplicate_post() function does not verify that the user has the 'edit_others_posts' capability before allowing duplication of posts with a specified author. This allows authenticated users with Contributor-level access or higher to create duplicated posts attributed to any user, including administrators.

The Post Duplicator plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.0.11. The flaw allows authenticated users with Contributor-level access or higher to duplicate posts with future or private status, bypassing editorial review. The REST endpoint also ignores administrator-configured restrictions on which post types can be duplicated.

Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

CVE-2026-39474 is a high-severity vulnerability in metaphorcreations Post Duplicator plugin versions up to and including 3.0.10. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with low privileges to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-9011 is an authorization bypass vulnerability in the Ditty – Responsive News Tickers, Sliders, and Lists WordPress plugin up to version 3.1.65. The flaw allows unauthenticated attackers to access full content of non-public Ditty items, including drafts and disabled entries, by exploiting an AJAX endpoint that does not verify post status. This bypass exposes content that administrators intended to keep private. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation guidance is currently available from the vendor.

The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the `duplicate_post()` function in `includes/api.php` using `$wpdb->insert()` directly to the `wp_postmeta` table instead of WordPress's standard `add_post_meta()` function, which would call `is_protected_meta()` to prevent lower-privileged users from setting protected meta keys (those starting with `_`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as `_wp_page_template`, `_wp_attached_file`, and other sensitive meta keys on duplicated posts via the `customMetaData` JSON array parameter in the `/wp-json/post-duplicator/v1/duplicate-post` REST API endpoint.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.

Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through <= 2.35.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Metaphor Widgets allows Stored XSS. This issue affects Metaphor Widgets: from n/a through 2.4.

The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.

The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.