WPIntell

Source evidence

PATCHSTACK: Cross Site Scripting Vulnerability

Ditty – Responsive News Tickers, Sliders, and Lists · support · 2025-09-28T16:36:00+00:00

Ditty – Responsive News Tickers, Sliders, and Lists plugin evidence original source source API
mixedsentiment
mediumseverity
0.62relevance
8replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 33 rows with source links

15.2% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

28 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
code3creative resolved
Two days ago, Patchstack posted a Cross Site Scripting (XSS) vulnerability for this plugin:( https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-58-cross-site-scripting-xss-vulnerability?_a_id=350 ). Is there a patch coming from this? Yes, it would be great if we could have a patch for this also. Many Thanks Thanks for letting me know about this. For some reason I never received a notification on this issue so I am checking with Patchstack to get more details. As soon as I find out more and resolve the issue I will post an update. Following I was able to track down the patchstack notice and the issue listed was already fixed in version 3.1.58. I have resubmitted the update to patchstack so hopefully they close out the notice soon. They previously confirmed with me that it was closed, but for some reason it’s still open. Sounds good, thanks for the quick update! I released another small update to ensure this issue was resolved. Please update to version 3.1.59 when you get a chance. Hi @joemc , thank you for fixing this. I can now confirm that the warning has disappeared from Wordfence too after updating to 3.1.59. @mikii thanks for letting me know!

Comments

8 shown
creativeimpact 2025-09-29T08:29:00+00:00

Yes, it would be great if we could have a patch for this also. Many Thanks

Joe 2025-09-29T15:23:00+00:00

Thanks for letting me know about this. For some reason I never received a notification on this issue so I am checking with Patchstack to get more details. As soon as I find out more and resolve the issue I will post an update.

rsb1234 2025-09-30T07:51:00+00:00

Following

Joe 2025-09-30T10:32:00+00:00

I was able to track down the patchstack notice and the issue listed was already fixed in version 3.1.58. I have resubmitted the update to patchstack so hopefully they close out the notice soon. They previously confirmed with me that it was closed, but for some reason it’s still open.

code3creative 2025-09-30T22:14:00+00:00

Sounds good, thanks for the quick update!

Joe 2025-10-06T13:15:00+00:00

I released another small update to ensure this issue was resolved. Please update to version 3.1.59 when you get a chance.

mikii 2025-10-07T06:31:00+00:00

Hi @joemc , thank you for fixing this. I can now confirm that the warning has disappeared from Wordfence too after updating to 3.1.59.

Joe 2025-10-07T11:13:00+00:00

@mikii thanks for letting me know!