The DWT - Directory & Listing WordPress Theme versions up to 3.3.3 suffer from a reflected XSS vulnerability due to improper neutralization of input in the 'sort_by' and 'token' parameters. This allows attackers to inject malicious scripts that execute in the context of the victim's browser when they click a manipulated link. The vulnerability requires user interaction and does not require privileges. It impacts confidentiality and integrity but not availability, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in theft of sensitive information or session hijacking. The vulnerability affects confidentiality and integrity but does not impact system availability. It requires user interaction and no authentication, increasing the risk of exploitation via phishing or social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links involving the affected parameters. Website administrators should consider implementing web application firewall rules to detect and block malicious input targeting 'sort_by' and 'token' parameters.