CVE-2025-0170: DWT WordPress Theme XSS Vulnerability

CVE-2025-0170 Overview

CVE-2025-0170 is a reflected Cross-Site Scripting (XSS) vulnerability in the DWT - Directory & Listing WordPress Theme. The flaw affects all versions up to and including 3.3.3. It stems from insufficient input sanitization and output escaping on the sort_by and token parameters. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and redirection to attacker-controlled infrastructure.

Affected Products

DWT - Directory & Listing WordPress Theme versions up to and including 3.3.3
WordPress sites deploying the vulnerable theme in production
All site visitors and authenticated users of affected installations

Discovery Timeline

2025-01-16 - CVE-2025-0170 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0170

Vulnerability Analysis

The DWT theme processes user-supplied values from the sort_by and token query parameters without applying sufficient sanitization or output escaping. When the theme renders these parameter values back into the HTML response, an attacker can supply JavaScript payloads that the browser interprets as executable code. Because the injection is reflected in the immediate response, exploitation requires user interaction — typically clicking a crafted URL. The vulnerability requires no authentication and impacts confidentiality and integrity of the victim's session context. The EPSS probability is 0.28%, placing it in the 20th percentile of exploited vulnerabilities.

Root Cause

The root cause is missing input sanitization on incoming request parameters and missing output escaping when reflecting those values into rendered pages. WordPress provides escaping helpers such as esc_attr(), esc_html(), and esc_url(), but the theme's handlers for sort_by and token do not apply them before echoing user-controlled data into the HTML context.

Attack Vector

An attacker crafts a URL targeting a vulnerable DWT theme endpoint with a malicious payload embedded in either the sort_by or token parameter. The attacker delivers the URL through phishing, social media, or malicious advertising. When a victim clicks the link, the WordPress site reflects the payload into the response, and the victim's browser executes the injected script in the site's origin. This allows the attacker to steal cookies, hijack sessions, perform actions on behalf of authenticated users, or redirect visitors to malicious sites.

The vulnerability manifests in the theme's parameter handling logic. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-0170

Indicators of Compromise

HTTP requests to WordPress endpoints containing sort_by or token parameters with <script>, javascript:, onerror=, or onload= payloads
Referrer logs showing external sources directing users to URLs with encoded script content in query strings
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting the site
Anomalous authenticated session activity following visits from external referrers

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that flags requests containing HTML tags or JavaScript event handlers in sort_by and token parameters
Review WordPress access logs for URL-encoded XSS signatures such as %3Cscript%3E or %3Cimg
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts

Monitoring Recommendations

Correlate web server access logs with authentication events to identify session hijacking following XSS delivery
Monitor for spikes in traffic to theme endpoints from unusual referrers or short-lived campaign URLs
Alert on administrator account activity originating from IPs that recently loaded reflected content

How to Mitigate CVE-2025-0170

Immediate Actions Required

Update the DWT - Directory & Listing WordPress Theme to a version later than 3.3.3 once released by the vendor
Deploy WAF rules blocking script tags and JavaScript event handlers in the sort_by and token parameters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources
Notify administrators and privileged users to avoid clicking untrusted links to the site

Patch Information

Consult the vendor documentation at the DWT Directory & Listing WordPress Theme documentation and the Wordfence advisory for the latest patched release. Apply theme updates through the WordPress admin dashboard or via secure file transfer to the theme directory.

Workarounds

Restrict access to the affected theme endpoints using server-side rules until a patched version is installed
Implement input filtering at the reverse proxy or WAF layer to strip HTML metacharacters from sort_by and token parameters
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script injection
Enable browser-side XSS protections through response headers such as X-Content-Type-Options: nosniff and a restrictive Content-Security-Policy

bash

# Example nginx WAF-style rule to block script payloads in vulnerable parameters
if ($args ~* "(sort_by|token)=.*(<script|javascript:|onerror=|onload=)") {
    return 403;
}

# Recommended response headers for defense-in-depth
add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";