Known vulnerabilities in Ditty – Responsive News Tickers, Sliders, and Lists

Ditty offers a range of content display options, including its signature news ticker and customizable layouts.

9Reported vulnerabilities

8.8Highest CVSS score

3.1.67Latest version

30,000+Active installs

What to do now

Update Ditty – Responsive News Tickers, Sliders, and Lists to 3.1.69 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 24, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2022-0533	Medium 6.1	1.8%	Before 3.0.15	`3.0.15`	March 7, 2022
CVE-2024-3954	High 8.8	0.7%	3.1.38 and earlier	`3.1.39`	May 7, 2024
CVE-2026-9011	High 7.5	0.5%	0 to 3.1.65 (inclusive)	`3.1.66`	May 22, 2026
CVE-2023-23874	Medium 6.4	0.4%	3.0.32 and earlier	`3.0.33`	February 20, 2023
CVE-2025-60105	Medium 6.4	0.2%	3.1.58 and earlier	`3.1.59`	September 26, 2025
CVE-2024-32569	Medium 5.4	0.3%	3.1.31 and earlier	`3.1.32`	April 16, 2024
CVE-2026-27355	Medium 5.3	0.4%	3.1.66 and earlier	`3.1.67`	July 22, 2026
CVE-2023-47764	Medium 5.3	0.4%	3.1.24 and earlier	`3.1.25`	November 13, 2023
CVE-2026-81274	Medium 4.3	0.3%	3.1.67 and earlier	`3.1.69`	August 26, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.