CVE-2024-3201 is a stored cross-site scripting vulnerability in the WP DSGVO Tools (GDPR) WordPress plugin, affecting all versions up to and including 3.1.32. The issue arises from inadequate sanitization and escaping of user-supplied attributes in the 'pp_link' shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary JavaScript code. This code executes in the context of any user visiting the compromised page, potentially leading to session hijacking or other client-side attacks. The CVSS 3.1 base score is 6.4 (medium), with attack vector network, low attack complexity, privileges required (low), no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected page, potentially compromising user sessions or data confidentiality and integrity. There is no indication of impact on system availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the 'pp_link' shortcode functionality if possible to reduce exposure.