Input validation vulnerability in DWT – Directory & Listing WordPress Theme 3.3.3

The DWT WordPress Theme, up to version 3.3.3, has a security vulnerability called Reflected Cross-Site Scripting. This is because the theme does not properly clean and protect the ‘sort_by’ and ‘token’ parameters, which can allow attackers to insert harmful scripts into pages. If a user is tricked into clicking a link, these scripts can be executed, giving the attacker access to the user’s information.