Dwt Listing Vulnerabilities

The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password()...

CVSS:

9.8

Affected:

up to 3.3.6

Fixed in:

3.3.7

Disclosed:

Jun 26, 2025

CVE-2024-12827 on NVD →

The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above pe...

CVSS:

6.4

Affected:

up to 3.3.4

Fixed in:

3.3.5

Disclosed:

Feb 8, 2025

CVE-2025-0169 on NVD →

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sort_by' and 'token' parameters. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

CVSS:

6.1

Affected:

up to 3.3.3

Fixed in:

3.3.4

Disclosed:

Jan 15, 2025

CVE-2025-0170 on NVD →