PT-2025-43703 · WordPress · Watu Quiz

Naoya Takahashi · Published 2025-10-25 · Updated 2025-10-30 · CVE-2025-11238

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Watu Quiz plugin for WordPress versions prior to 3.4.5

Description The Watu Quiz plugin for WordPress is susceptible to Stored Cross-Site Scripting through the HTTP Referer header. This occurs because of inadequate input sanitization and output escaping when the "Save source URL" option is enabled. This allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses the injected page.

Recommendations Update the Watu Quiz plugin to version 3.4.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11238

Affected Products

Watu Quiz

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11238 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/168e7eac-21ad-43ca-93d1-73c38e12bc29?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1982001597568737511 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1983178832799736133 · Twitter Post
• https://twitter.com/CVEnew/status/1981959761844121815 · Twitter Post
• https://twitter.com/cracbot/status/1983851413722820873 · Twitter Post
• https://t.me/cveNotify/140332 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3373855/watu · Note