Skip to content
PluginCanary

Ditty

Ditty - Responsive News Tickers, Sliders, and Lists
by metaphorcreations · 30,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 3 Nov 2026, 23 releases in 24 months, no unpatched vulnerabilities.

80/ 100 Canary Score
Sub-scores for Ditty
Ownership100
Maintenance100
Security60
Support70
Reputation60

How the score works

Quick answers

Is Ditty still maintained?
Yes. Last release 3 Nov 2026, 23 releases in the last 24 months. 3 Nov 2026 · wordpress.org
Who owns Ditty, and has it changed hands?
No change recorded. Main committer metaphorcreations since Jan 2013. 4 Nov 2026 · SVN log
Was Ditty removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Ditty safe?
19 known vulnerabilities, all fixed (latest in 3.1.70). Not on the exploited list. 23 Sep 2026 · Wordfence Intelligence
Is the latest Ditty update safe to install?
No ownership change before 3.1.72. No one-star spike after it. 3 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
metaphorcreations24 Jan 2013 to 3 Nov 2026, 488 commits

1 committer recorded. No ownership change since 2013.

Maintenance

Last release
yesterday
Releases, 24 months
23
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Ditty
Q1 20243
Q2 202412
Q3 20242
Q4 20245
Q1 20253
Q2 20252
Q3 20252
Q4 20253
Q1 20263
Q2 20262
Q3 20264
Q4 20261

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.6.

Average rating per quarter for Ditty
Q4 20233.7
Q1 20245.0
Q2 20245.0
Q1 20255.0
Q2 20255.0
Q1 20265.0

Average rating rose from 3.7 to 5.0 between Q4 2023 and Q1 2026.

Rating distribution
5 star89
4 star6
3 star3
2 star1
1 star7
Latest low reviews

Security record

8 vulnerabilities in 24 months (19 on record), all patched (latest fixed in 3.1.70).

Show 19 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
23 Sep 2026Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.1.693.1.70Patched before disclosure
21 Sep 2026Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 3.1.693.1.70Patched before disclosure
26 Aug 2026Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.67 - Missing Authorization4.3<= 3.1.673.1.69Patched before disclosure
22 Jul 2026Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.66 - Missing Authorization5.3<= 3.1.663.1.673
21 May 2026Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action7.5<= 3.1.653.1.66Patched before disclosure
26 Sep 2025Ditty <= 3.1.58 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.1.583.1.5911
18 Aug 2025Ditty <= 3.1.57 - Unauthenticated Server-Side Request Forgery7.2<= 3.1.573.1.58Patched before disclosure
6 Mar 2025Ditty <= 3.1.51 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 3.1.513.1.52Patched before disclosure
31 Oct 2024Ditty <= 3.1.46 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 3.1.463.1.47Patched before disclosure
2 Aug 2024Ditty 3.1.39 - 3.1.45 - Authenticated (Author+) Stored Cross-Site Scripting6.43.1.39 to 3.1.453.1.46Patched before disclosure
15 Jul 2024Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 3.1.443.1.45Patched before disclosure
22 Jun 2024Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.42 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 3.1.423.1.43Patched before disclosure
7 May 2024Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection8.8<= 3.1.383.1.39Patched before disclosure
6 May 2024Ditty <= 3.1.35 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 3.1.353.1.36Patched before disclosure
16 Apr 2024Ditty - Responsive News Tickers, Sliders, and Lists <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting5.4<= 3.1.313.1.32Patched before disclosure
13 Nov 2023Ditty <= 3.1.24 - Missing Authorization via save_ditty_permissions_check5.3<= 3.1.243.1.25Patched before disclosure
29 Aug 2023Ditty <= 3.1.24 - Reflected Cross-Site Scripting6.1< 3.1.253.1.25Patched before disclosure
20 Feb 2023Ditty <= 3.0.32 - Authenticated (Contributor+) Stored Cross-Scripting via Shortcode6.4<= 3.0.323.0.33Patched before disclosure
9 Feb 2022Ditty (formerly Ditty News Ticker) <= 3.0.14 - Reflected Cross-Site Scripting6.1< 3.0.153.0.15Patched before disclosure

Changelog mentions of security fixes: 3.1.67 (security, vulnerability); 3.1.69 (security, vulnerability); 3.1.70 (security); 3.1.71 (security, sanitize); 3.1.72 (security, escaping).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 3 support threads resolved in the last 2 months.

Momentum

30,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Ditty
4 May 2026684
11 May 202613,960
18 May 202618,072
25 May 20263,688
1 Jun 20262,180
8 Jun 20261,787
15 Jun 20261,467
22 Jun 20261,305
29 Jun 20261,390
6 Jul 20261,273
13 Jul 20261,183
20 Jul 202612,500
27 Jul 20265,541
3 Aug 20263,639
10 Aug 20261,877
17 Aug 20266,920
24 Aug 202610,898
31 Aug 20262,978
7 Sep 20261,941
14 Sep 20262,573
21 Sep 202629,029
28 Sep 20263,312
5 Oct 20262,419
12 Oct 20261,792
19 Oct 20262,490
26 Oct 20261,834
2 Nov 2026278

Weekly downloads over the last 4 weeks are 68% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

AnnouncerScore 91 · 10,000+WPFront Notification BarScore 90 · 40,000+HurryTimerScore 90 · 20,000+PiWeb Live sales notification forScore 89 · 40,000+My Sticky BarScore 87 · 100,000+

Facts

Version3.1.72
Authormetaphorcreations
Added24 Jan 2013
Last updated3 Nov 2026
Active installs30,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP7.4
CategoryContent Management > Blog & Article Publishing
Tagsnews ticker, post slider, Post ticker, content slider, responsive slider

Other plugins by this author: Post Duplicator

Questions

Is Ditty still maintained?

Yes. Last release 3 Nov 2026, 23 releases in the last 24 months.

Who owns Ditty, and has it changed hands?

No change recorded. Main committer metaphorcreations since Jan 2013.

Was Ditty removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Ditty safe?

19 known vulnerabilities, all fixed (latest in 3.1.70). Not on the exploited list.

Is the latest Ditty update safe to install?

No ownership change before 3.1.72. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue