CVE-2024-10388 is a stored cross-site scripting vulnerability in the welaunch WordPress GDPR plugin affecting all versions up to 2.0.2. The issue is due to insufficient input sanitization and output escaping of the 'gdpr_firstname' and 'gdpr_lastname' parameters, which enables unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other client-side impacts. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope changed.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks by injecting malicious scripts into the 'gdpr_firstname' and 'gdpr_lastname' fields. This can lead to unauthorized actions in the context of affected users, including theft of sensitive information or session tokens. There is no indication of impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates or patches addressing this vulnerability.