Skip to content
Sign in
6.1 Medium

CVE-2025-0170 The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and…

Description

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sort_by' and 'token' parameters. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products and versions

Product Affected versions Fixed in
DWT - Directory & Listing WordPress Theme 3.3 earliest → 3.3.3 No fix stated

Other CVEs of DWT - Directory & Listing WordPress Theme

The 3 CVEs of DWT - Directory & Listing WordPress Theme →
CVE-2024-12827 The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account… 9.8 Critical CVE-2025-0169 The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up… 6.4 Medium
Track this CVE