CVE-2024-11198 is a stored cross-site scripting vulnerability in the GD Rating System WordPress plugin affecting all versions up to 3.6.1. The vulnerability is due to improper neutralization of input in the 'extra_class' parameter, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the low level, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no direct availability impact. The vulnerability does not appear to be exploited in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the GD Rating System plugin if possible. Monitor official gdragon or WordPress plugin sources for updates addressing this vulnerability.