← back to popular plugins
wordfence / plugin · rafflepress
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
rafflepress
total installs
30,000
total vulns
3
critical
0
high
1
medium
2
low
0
latest vuln
—
patched
3
unpatched
0
avg time to patch
—
vulnerabilities
(3)
Giveaways and Contests by RafflePress <= 1.12.20 - Cross-Site Request Forgery
medium
✓ patched
cve id
CVE-2025-66064 ↗
cvss score
4.3
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Nov 21, 2025
The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2025-12484 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Nov 18, 2025
The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple social media username parameters in all versions up to, and including, 1.12.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Giveaways and Contests by RafflePress <= 1.12.18 - Missing Authorization
medium
✓ patched
The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.12.18. This makes it possible for unauthenticated attackers to perform an unauthorized action.