The vulnerability arises from improper neutralization of user input when generating a web page. An attacker can craft a request containing malicious scripts that are echoed back to the victim’s browser, enabling the execution of arbitrary JavaScript in the context of the site’s domain. This can lead to cookie theft, defacement, or malicious redirects. The flaw is a classic Reflected XSS labeled CWE‑79.

Affected is the Watu Quiz plugin for WordPress, developed by Bob (Bob Watu Quiz). All released versions up to and including 3.4.2 are vulnerable. WordPress sites that have installed the plugin in these versions must consider remediation.

The CVSS v3.1 score of 7.1 indicates a medium‑to‑high severity, while the EPSS score of less than 1 % suggests a low probability of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a crafted URL or input field that reflects back unfiltered data; an attacker only needs to send a request to the site hosting the plugin to trigger the script execution in a visitor’s browser.