CVE-2024-11325 is a reflected cross-site scripting vulnerability in the AWeber Forms by Optin Cat WordPress plugin, present in all versions up to 2.5.7. The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling injection of malicious scripts. An unauthenticated attacker can exploit this by crafting a URL that, when visited by a user, executes arbitrary JavaScript in the context of the affected site. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 5.2, indicating medium severity. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a malicious link. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. The attack requires user interaction (clicking a link) and no privileges are needed by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links related to the affected plugin and consider disabling or removing the plugin if possible. Monitoring vendor channels for updates is recommended.