DWT Directory and Listing WordPress Theme Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the DWT - Directory & Listing WordPress Theme, affecting versions through 3.3.3. The issue arises from inadequate input sanitization and output escaping on the 'sort_by' and 'token' parameters. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages, which could be executed if a user is tricked into clicking a link.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to version 3.3.4 or a newer patched version to address this vulnerability.