PatchTheCVEditty vulnerabilities and fixes
Recent CVEs affecting ditty, with upgrade or downgrade steps. 6 tracked.
ditty has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-09-08. Highest priority: CVE-2025-8085 (score 64/100).
- CVE-2025-8085 HIGH 8.6 UPGRADE The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayIt
- CVE-2024-9600 MEDIUM 4.8 UPGRADE The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow
- CVE-2024-6710 MEDIUM 5.4 UPGRADE The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow user
- CVE-2024-5575 MEDIUM 4.7 UPGRADE The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which cou
- CVE-2024-3939 MEDIUM 5.4 UPGRADE The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow
- CVE-2024-13357 MEDIUM 4.8 UPGRADE The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow
FAQ
How do I fix ditty vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ditty being exploited right now?
None of the tracked ditty CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ditty CVE should I patch first?
CVE-2025-8085 currently ranks highest (64/100): The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayIt.