Giveaways and Contests by RafflePress < 1.11.3 - Contributor+ Stored XSS

2023-01-1200:00:00

Lana Codes

rafflepress

giveaways

contests

stored xss

EPSS

0.001

Percentile

25.5%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

[rafflepress id='1' min_height="'); alert(1); ('"]

Note: First, you need to add a RafflePress Giveaway.

EPSS

0.001

Percentile

25.5%

JSON

Related for WPEX-ID:A762C25B-5C47-400E-8964-407CF4C94E9F