Vulnerabilities

TI-2024-03697 CVE-2024-3963 · GHSA-cf3c-mjjg-mw7c

RafflePress Lite < 1.12.14 - Editor+ Stored XSS

MEDIUM 62

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00477 Published 2024-07-13 Fixed in 1.12.14 CWE-79

TI-2024-04418 CVE-2024-4745 · GHSA-m95c-chfx-gfmj

WordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerability

LOW 28

Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00251 Published 2024-06-10 No fix listed CWE-862

TI-2024-21701 CVE-2024-32827 · GHSA-9f74-xw28-qc4r

WordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerability

LOW 32

Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: from n/a through 1.12.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00385 Published 2024-05-17 No fix listed CWE-290

TI-2024-01802 CVE-2024-1935 · GHSA-xxpv-3q6j-c873

Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting

LOW 33

The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘parent_url’ parameter in all versio…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00685 Published 2024-03-13 No fix listed CWE-79

TI-2023-00170 CVE-2023-0176 · GHSA-fqww-44f8-q7w7

Giveaways and Contests by RafflePress < 1.11.3 - Contributor+ Stored XSS

MEDIUM 58

The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00573 Published 2023-02-06 Fixed in 1.11.3