Medium severity · published Sep 25, 2023
CVE-2023-4148
Ditty < 3.1.25 - Reflected XSS
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Ditty ·
before 3.1.25 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4148
Exploit
https://wpscan.com/vulnerability/aa39de78-55b3-4237-84db-6fdf6820c58d
More from Ditty
8.6
CVE-2025-8085
Ditty < 3.1.58 - Unauthenticated SSRF
6.1
CVE-2024-6715
Ditty 3.1.39-3.1.45 - Author+ Stored XSS
5.4
CVE-2024-6710
Ditty < 3.1.45 - Author+ Stored XSS
5.4
CVE-2024-3939
Ditty < 3.1.36 - Author+ Stored XSS
4.8
CVE-2024-13357
Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS