CVE-2026-97318
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
Risk Assessment
An attacker can redirect users to malicious external sites, potentially leading to phishing or malware distribution. This undermines trust in the site and its links.
Recommendation
Update the Giveaways and Contests by RafflePress plugin to version 1.12.27 or later. Review existing giveaway configurations for invalid parent page URLs.
Other vulnerabilities in Giveaways and Contests by RafflePress
See all- CVE-2026-97317Medium
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.
- CVE-2025-66064Medium
The WordPress plugin "Giveaways and Contests by RafflePress" is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.12.20. Missing or incorrect nonce validation allows unauthenticated attackers to perform actions on behalf of an administrator.
Original NVD description (English source)
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS