WordPress ditty has 8 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-8085 | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthe | high | 8.6 | <3.1.58 | 3.1.58 |
| CVE-2023-4148 | The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attr | medium | 6.1 | <3.1.25 | 3.1.25 |
| CVE-2024-5575 | The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users | medium | 4.7 | <3.1.43 | 3.1.43 |
| CVE-2024-3939 | The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 5.4 | <3.1.36 | 3.1.36 |
| CVE-2024-9600 | The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | <3.1.47 | 3.1.47 |
| CVE-2024-6710 | The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contri | medium | 5.4 | <3.1.46 | 3.1.46 |
| CVE-2024-6715 | The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-48 | medium | 6.1 | <3.1.46 | 3.1.46 |
| CVE-2024-13357 | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as | medium | 4.8 | <3.1.52 | 3.1.52 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked