PatchTheCVEmetaphorcreations vulnerabilities
Recent CVEs affecting metaphorcreations products. 8 tracked.
metaphorcreations has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2025-09-08. Highest priority: CVE-2025-8085 (score 64/100).
- CVE-2025-8085 HIGH 8.6 UPGRADE The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayIt
- CVE-2025-24736 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Inc
- CVE-2024-9600 MEDIUM 4.8 UPGRADE The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow
- CVE-2024-6710 MEDIUM 5.4 UPGRADE The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow user
- CVE-2024-5575 MEDIUM 4.7 UPGRADE The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which cou
- CVE-2024-13357 MEDIUM 4.8 UPGRADE The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow
- CVE-2024-12472 MEDIUM 4.3 UPGRADE The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and incl
- CVE-2023-49835 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Config
FAQ
How do I fix metaphorcreations vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is metaphorcreations being exploited right now?
None of the tracked metaphorcreations CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which metaphorcreations CVE should I patch first?
CVE-2025-8085 currently ranks highest (64/100): The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayIt.