Rafflepress

rafflepress

3 CVEs • 2 products

Products (2)

Click to collapse

Toggle

Giveaways And Contests By Rafflepress

giveaways_and_contests_by_rafflepress

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-3963 1Rafflepress 1Rafflepress Jun 17, 2026 Jul 13, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
CVE-2024-1935 1Rafflepress 1Rafflepress Jun 17, 2026 Mar 13, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘parent_url’ parameter in all versio...Show more The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘parent_url’ parameter in all versions up to, and including, 1.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-0176 1Rafflepress 1Giveaways And Contests By Rafflepress Jun 17, 2026 Feb 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could...Show more The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.Show less