CVE-2025-0169

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0169", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-01T18:15:28.530Z", "datePublished": "2025-02-08T22:21:30.776Z", "dateUpdated": "2026-04-08T17:19:06.626Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:06.626Z"}, "affected": [{"vendor": "scriptsbundle", "product": "DWT - Directory & Listing WordPress Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "DWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be0c29a3-0b78-4259-a514-c3674d9d5d55?source=cve"}, {"url": "https://themeforest.net/item/dwt-listing-directory-listing-wordpress-theme/21976132"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-01-01T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-01-01T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-08T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0169", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-10T13:41:54.106997Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:51:42.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0169", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-10T13:41:54.106997Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:46:39.213Z"}}], "cna": {"title": "DWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "scriptsbundle", "product": "DWT - Directory & Listing WordPress Theme", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.3.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-01T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-01-01T00:00:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-02-08T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be0c29a3-0b78-4259-a514-c3674d9d5d55?source=cve"}, {"url": "https://themeforest.net/item/dwt-listing-directory-listing-wordpress-theme/21976132"}], "descriptions": [{"lang": "en", "value": "The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-02-08T22:21:30.776Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0169", "state": "PUBLISHED", "dateUpdated": "2025-02-12T20:51:42.769Z", "dateReserved": "2025-01-01T18:15:28.530Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-08T22:21:30.776Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DWT - Directory & Listing WordPress Theme", "vendor": "scriptsbundle", "versions": [{"lessThanOrEqual": "3.3.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:scriptsbundle:dwt_listing:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "54DA90E5-AFC1-43D8-8181-E9474CD86D5D", "versionEndExcluding": "3.3.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El tema DWT - Directory &amp; Listing de WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de c\u00f3digos cortos en versiones hasta la 3.3.4 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en atributos proporcionados por el usuario. Esto permite que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0169", "lastModified": "2026-06-17T08:26:00.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0169", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-10T13:41:54.106997Z", "version": "2.0.3"}}]}, "published": "2025-02-08T23:15:08.653", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://themeforest.net/item/dwt-listing-directory-listing-wordpress-theme/21976132"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be0c29a3-0b78-4259-a514-c3674d9d5d55?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:23:38.262585+00:00", "value": {"mitigation_remediation": ["Apply the latest DWT theme update (3.3.5 or later) as soon as the vendor releases it.", "If an update is not immediately available, remove or disable the vulnerable shortcode from all pages and revoke any contributor roles that allow shortcode editing to prevent further injections.", "Use WordPress\u2019 built\u2011in sanitization functions (e.g., wp_kses, esc_html) for all shortcode parameters or employ a security plugin that enforces proper output escaping to block future script injections."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via contributor\u2011level shortcode injection"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the DWT Directory & Listing WordPress Theme in versions up to and including 3.3.4, purchased from ThemeForest. These sites are vulnerable regardless of the rest of the theme or WordPress core version, provided the vulnerable shortcodes remain active.", "description_and_impact": "The vulnerability in the DWT Directory & Listing WordPress Theme allows authenticated users with contributor\u2011level or higher permissions to inject arbitrary JavaScript through shortcodes because the theme does not properly sanitize or escape user\u2011supplied attributes. When a malicious script is stored in this manner, it executes in the browser of any visitor who loads the affected page, potentially allowing the attacker to steal session cookies, deface content, or perform phishing attacks. The underlying flaw is a typical improper input validation weakness (CWE\u201179).", "risk_and_exploitability": "The CVSS base score is 6.4, indicating medium severity. The EPSS score shows a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog, meaning it has not yet been observed in active exploitation. Attackers must possess at least contributor privileges to inject the payload, and the injected script will affect all subsequent visitors to the impacted page. No public exploit has been documented, but the flaw\u2019s nature means it could be leveraged fairly easily if a patch is not applied."}}}}, "created": "2026-04-21T22:30:06.133460+00:00", "updated": "2026-04-21T22:30:06.133477+00:00", "vendors": []}