Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

metaphorcreations — Vulnerabilities & Security Advisories 14

Browse all 14 CVE security advisories affecting metaphorcreations. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Metaphorcreations develops web applications and content management systems, primarily serving businesses needing customizable online platforms. Historically, their products have been vulnerable to remote code execution, cross-site scripting, and privilege escalation vulnerabilities, often stemming from insufficient input validation and access control flaws. The organization has addressed multiple critical security issues, with seven CVEs documenting weaknesses in components allowing unauthorized administrative access and persistent XSS attacks. While no major public security incidents have been widely reported, their vulnerability history indicates a pattern of security gaps in user authentication and data sanitization that have required remediation through security patches and version updates.

CVE ID Title CVSS Severity Published
CVE-2026-94461 WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability — Ditty CWE-79 6.5 Medium 2026-09-23
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability — Ditty CWE-862 5.3 Medium 2026-08-27
CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution — Post Duplicator CWE-862 4.3 Medium 2026-08-22
CVE-2026-4245 Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication — Post Duplicator CWE-863 4.3 Medium 2026-08-22
CVE-2026-27355 WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability — Ditty CWE-862 5.3 Medium 2026-07-23
CVE-2026-39474 WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability — Post Duplicator CWE-502 8.8 High 2026-06-15
CVE-2026-9011 Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action — Ditty – Responsive News Tickers, Sliders, and Lists CWE-862 7.5 High 2026-05-22
CVE-2026-2301 Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter — Post Duplicator CWE-862 4.3 Medium 2026-02-25
CVE-2025-60105 WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability — Ditty CWE-79 6.5 Medium 2025-09-26
CVE-2025-24736 WordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerability — Post Duplicator CWE-862 4.3 Medium 2025-01-24
CVE-2025-23816 WordPress Metaphor Widgets plugin <= 2.4 - Stored Cross Site Scripting (XSS) vulnerability — Metaphor Widgets CWE-79 6.5 Medium 2025-01-16
CVE-2024-12472 Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure — Post Duplicator CWE-639 4.3 Medium 2025-01-11
CVE-2023-47764 WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability — Ditty CWE-862 6.5 Medium 2024-12-09
CVE-2024-3954 Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection — Ditty – Responsive News Tickers, Sliders, and Lists CWE-502 8.8 High 2024-05-09

This page lists every published CVE security advisory associated with metaphorcreations. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.