CVE-2025-11238 is a stored cross-site scripting vulnerability in the Watu Quiz WordPress plugin by prasunsen, affecting versions up to and including 3.4.4. The issue occurs due to improper neutralization of input from the HTTP Referer header when the "Save source URL" option is enabled, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts via the HTTP Referer header, which execute in the browsers of users visiting affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the "Save source URL" option in the Watu Quiz plugin to prevent exploitation. Monitor for updates from the vendor prasunsen and apply patches promptly once released.