The DWT – Directory & Listing WordPress Theme is affected by a reflected cross‑site scripting flaw. The bug stems from insufficient sanitization and output escaping on the sort_by and token URL parameters, allowing an attacker to inject arbitrary client‑side scripts when a victim follows a crafted link. This could enable defacement, credential theft, or execution of malicious actions in the victim’s browser, depending on the user’s privileges. The weakness is an instance of CWE‑79, Improper Neutralization of Input During Web Page Generation.

This vulnerability affects the ScriptsBundle DWT – Directory & Listing WordPress Theme versions up to and including 3.3.3. No other vendors or product variants were identified as impacted by the CNA advisory. Any WordPress deployment using one of these affected theme releases is therefore at risk.

The CVSS base score is 6.1, indicating a moderate severity for a reflected XSS vector. The EPSS score of less than 1% suggests that the probability of active exploitation at any given time is low, and the issue is not currently listed in CISA’s KEV catalog. Nonetheless, because the attack requires only a malicious link and no authentication, a widespread social engineering campaign could effectively target users if the vulnerability remains unpatched.