CVE-2024-32827

Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: from n/a through 1.12.7...

CVE-2024-4745

Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4...

CVE-2024-10107: Improper Neutralization of Input During Web Page Generation

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

WordPress plugin Giveaways and Contests by RafflePress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2025-32634 WordPress Run Contests, Raffles, and Giveaways plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Reflected XSS.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through = 2.1...

CVE-2025-32634

CVE-2025-32634 describes a Reflected XSS in the WordPress plugin Run Contests, Raffles, and Giveaways with ContestsWP (versions n/a through 2.0.6). The vulnerability arises from improper input neutralization during web page generation. Affected software is ContestsWP communications for Run Contes...

CVE-2025-32634: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Reflected XSS.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through = 2.1...

CVE-2024-13316: Missing Authorization

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswncreatediscount function in all versions up to, and including, 2.8.0. This makes...

WordPress Scratch & Win – Giveaways and Contests plugin <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation vulnerability

Missing Authorization to Unauthenticated Coupon Creation vulnerability discovered by Peter Thaleikis in WordPress Plugin Scratch & Win – Giveaways and Contests versions = 2.8.0...

WordPress Giveaways and Contests by PromoSimple plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Giveaways and Contests by PromoSimple versions = 1.24...

CVE-2025-23934: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sam Brodie Giveaways and Contests by PromoSimple giveaways-contests-by-promosimple allows Stored XSS.This issue affects Giveaways and Contests by PromoSimple: from n/a through = 1.24...

WordPress plugin Giveaways and Contests by PromoSimple 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-5213

Name of the Vulnerable Software and Affected Versions PromoSimple Giveaways and Contests by PromoSimple versions 1.24 and earlier Description The issue affects PromoSimple Giveaways and Contests by PromoSimple, allowing Stored XSS due to improper neutralization of input during web page generation...

PT-2025-1687

Name of the Vulnerable Software and Affected Versions SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress versions up to, and including, 2.0.6 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode due to insufficien...

WordPress plugin SweepWidget Contests, Giveaways, Photo Contests, Competitions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-11756: Improper Neutralization of Input During Web Page Generation

The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping on user supplied...

WordPress SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin SweepWidget Contests, Giveaways, Photo Contests, Competitions versions = 2.0.6...

PT-2025-1893 · WordPress · Scratch & Win – Giveaways/Contests

Name of the Vulnerable Software and Affected Versions: The Scratch & Win – Giveaways and Contests plugin for WordPress versions up to, and including, 2.7.1 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the reset installation function. This allo...

CVE-2024-12545: Cross-Site Request Forgery (CSRF)

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the resetinstallation function...

CVE-2024-12513 Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RFCONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...