CVE-2025-8085High· 8.6▾ MidnightPoC availableThe Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
18%
18% → 20%
Nuclei ×1 (last check)
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
ditty < 3.1.58Upgrade past the affected range:
ditty 3.1.58Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2026-93339Medium· 5.4Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicio…
CVE-2021-21985Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server
CVE-2021-26855Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-34473Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2024-21893High· 8.2A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without auth…