CVE-2024-56262 describes a stored cross-site scripting vulnerability in the GS Coaches plugin by GS Plugins, affecting versions up to and including 1.1.0. The issue is due to improper input neutralization during web page generation, which can lead to the injection and persistent storage of malicious scripts. The CVSS 3.1 vector indicates the attack requires network access, low complexity, privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the affected plugin, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. However, no known exploits have been reported in the wild, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply general best practices such as limiting privileges of users who can input data and monitoring for suspicious activity related to the plugin. Avoid relying on this plugin version in sensitive environments if possible.