Read the docs
TI-2021-06590 Aliases CVE-2021-24298GHSA-jw46-grq7-cw4w

Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS

Why it matters now

EPSS 0.03451 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Simple Giveaways – Grow your business, email lists and traffic with contests (Igor Benic): 2.36.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Igor BenicSimple Giveaways – Grow your business, email lists and traffic with contests2.36.2 to before 2.36.22.36.2Patch availableCNA
  • Simple Giveaways – Grow your business, email lists and traffic with contests VendorIgor Benic Affected 2.36.2 to before 2.36.2 Fixed in 2.36.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibenic:simple_giveaways:*:*:*:*:*:wordpress:*:*before 2.36.2Vulnerableibenic
  • cpe:2.3:a:ibenic:simple_giveaways:*:*:*:*:*:wordpress:*:* Versions before 2.36.2 Vulnerable ·ibenic

Remediation

  • Fix · CNA Simple Giveaways – Grow your business, email lists and traffic with contests (Igor Benic) Fixed in 2.36.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24298
  2. 2026-10-03 Alias added: GHSA-jw46-grq7-cw4w

References

Exploit 2

  • TI-2026-41488 WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
  • TI-2025-22089 WordPress Simple Giveaways plugin <= 2.48.1 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
  • TI-2025-32792 WordPress Pets Plugin <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-35154 WordPress LeanPress plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2023-09692 WordPress Simple Giveaways plugin <= 2.48.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2025-30103 WordPress Simple Giveaways plugin <= 2.49.0 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences