CVE-2025-0169 is a stored cross-site scripting vulnerability in the DWT - Directory & Listing WordPress Theme by scriptsbundle. It affects versions up to 3.3.4 due to improper neutralization of input during web page generation (CWE-79). The issue allows authenticated users with contributor-level or higher privileges to inject malicious scripts via shortcode attributes that are not properly sanitized or escaped. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via shortcode attributes. When other users access these pages, the injected scripts execute in their browsers, potentially compromising user sessions or data confidentiality and integrity. There is no impact on availability. The vulnerability does not appear to be exploited in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling shortcode usage from untrusted sources. Monitor for updates from scriptsbundle regarding patches or official mitigations.