Metaphorcreations develops a focused set of WordPress plugins, primarily Ditty and Post Duplicator, that handle content presentation and management tasks across a modestly represented but notably vulnerable product line. The vendor's disclosures cluster around web application input-handling and authorization weaknesses—cross-site scripting, missing authorization controls, authorization bypass, and server-side request forgery—that are typical of plugins operating in the WordPress content-management context, and vulnerabilities affecting this vendor frequently acquire public exploit code. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Metaphorcreations over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-8085HIGH The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to ar | Sep 8, 2025 | 8.6 | 54 | NO | YES |
CVE-2026-39474HIGH Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. | Jun 15, 2026 | 8.8 | 31 | NO | NO |
CVE-2022-0533MEDIUM The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. | Mar 7, 2022 | 6.1 | 31 | NO | YES |
CVE-2023-4148MEDIUM The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site | Sep 25, 2023 | 6.1 | 28 | NO | YES |
CVE-2026-27355MEDIUM Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | Jul 23, 2026 | 5.3 | 25 | NO | NO |
CVE-2025-60105MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects | Sep 26, 2025 | 6.5 | 21 | NO | NO |
CVE-2016-15027MEDIUM A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice o | Feb 20, 2023 | 6.1 | 21 | NO | NO |
CVE-2021-33852MEDIUM A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given | Mar 10, 2022 | 5.4 | 20 | NO | NO |
CVE-2024-6715MEDIUM The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39 | Aug 23, 2024 | 6.1 | 19 | NO | NO |
CVE-2023-47764MEDIUM Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: f | Dec 9, 2024 | 6.5 | 18 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Metaphorcreations.
Media articles that mention a CVE ID that affects a product developed by Metaphorcreations — matched by CVE ID, not by vendor name.