CVE-2023-4148: falha de média gravidade em Ditty
Ditty < 3.1.25 - Reflected XSS
Publicada em · Atualizada em
28Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 6.1epss 0.8%
probabilidade de exploração
0.8%top 43% das CVEs
exploração observada
nãonenhuma fonte reporta
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · DittyCVEs relacionadas — Ditty
No mesmo produto, das mais perigosas para as menos.
CVE-2025-8085HIGHDitty < 3.1.58 - Unauthenticated SSRFEPSS 19.6%CVE-2024-5575MEDIUMDitty < 3.1.43 - Author+ Stored XSSEPSS 0.4%CVE-2024-3939MEDIUMDitty < 3.1.36 - Author+ Stored XSSEPSS 0.4%CVE-2024-9600MEDIUMDitty < 3.1.47 - Author+ Stored XSSEPSS 0.4%CVE-2024-6710MEDIUMDitty < 3.1.45 - Author+ Stored XSSEPSS 0.4%CVE-2024-6715MEDIUMDitty 3.1.39-3.1.45 - Author+ Stored XSSEPSS 0.3%