Giveaways And Contests By Rafflepress CVEs and Security Vulnerabilities

CVE-2026-97317

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rafflepress Wordpress-extensions

Products

Giveaways And Contests By Rafflepress Giveaways And Contests By Rafflepress

CVE-2026-97318

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed