Vulnerabilites related to seedprod - rafflepress
Vulnerability from fkie_nvd
Published
2024-09-12 06:15
Modified
2024-09-26 20:38
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
References
contact@wpscan.comhttps://wpscan.com/vulnerability/553806f4-da20-433c-8c19-35e6c87ccade/Exploit, Third Party Advisory
Impacted products
Vendor Product Version
seedprod rafflepress *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:seedprod:rafflepress:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "85440755-E301-4E45-9E91-BD81DFAE9B7A",
                     versionEndExcluding: "1.12.16",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Giveaways and Contests by RafflePress  WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
      },
      {
         lang: "es",
         value: "El complemento Giveaways and Contests by RafflePress para WordPress anterior a la versión 1.12.16 no desinfecta ni elude algunas de sus configuraciones de Sorteos, lo que podría permitir que usuarios con privilegios elevados, como editores y superiores, realicen ataques de cross site scripting almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio).",
      },
   ],
   id: "CVE-2024-6887",
   lastModified: "2024-09-26T20:38:26.743",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.8,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "HIGH",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.7,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.8,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "HIGH",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.7,
            impactScore: 2.7,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2024-09-12T06:15:24.293",
   references: [
      {
         source: "contact@wpscan.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://wpscan.com/vulnerability/553806f4-da20-433c-8c19-35e6c87ccade/",
      },
   ],
   sourceIdentifier: "contact@wpscan.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-06-10 08:15
Modified
2024-11-21 09:43
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Summary
Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.
References
audit@patchstack.comhttps://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cveThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cveThird Party Advisory
Impacted products
Vendor Product Version
seedprod rafflepress *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:seedprod:rafflepress:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "2711EBCE-B093-4E16-9CF2-CB99798A998F",
                     versionEndExcluding: "1.12.5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de autorización faltante en RafflePress Giveaways and Contests by RafflePress. Este problema afecta a los sorteos y concursos de RafflePress: desde n/a hasta 1.12.4.",
      },
   ],
   id: "CVE-2024-4745",
   lastModified: "2024-11-21T09:43:30.423",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "audit@patchstack.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 6.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-06-10T08:15:52.210",
   references: [
      {
         source: "audit@patchstack.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve",
      },
   ],
   sourceIdentifier: "audit@patchstack.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-862",
            },
         ],
         source: "audit@patchstack.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-10-30 14:15
Modified
2024-11-21 08:40
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796Patch
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955Patch
security@wordfence.comhttps://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0Patch
security@wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cveThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796Patch
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955Patch
af854a3a-2127-422b-91ae-364da2661108https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0Patch
af854a3a-2127-422b-91ae-364da2661108https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cveThird Party Advisory
Impacted products
Vendor Product Version
seedprod rafflepress *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:seedprod:rafflepress:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "56C015D5-0EEA-4E46-895B-70CDE7AF999E",
                     versionEndIncluding: "1.12.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
      },
      {
         lang: "es",
         value: "El complemento Giveaways and Contests by RafflePress para WordPress es vulnerable a Cross-Site Scripting almacenado a través del shortcode 'rafflepress' y 'rafflepress_gutenberg' en versiones hasta la 1.12.0 incluida debido a una sanitización de entrada y a un escape de salida en 'giframe' atributo proporcionado por el usuario insuficientes. Esto hace posible que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada.",
      },
   ],
   id: "CVE-2023-5049",
   lastModified: "2024-11-21T08:40:58.427",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.1,
            impactScore: 2.7,
            source: "security@wordfence.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-10-30T14:15:09.167",
   references: [
      {
         source: "security@wordfence.com",
         tags: [
            "Patch",
         ],
         url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796",
      },
      {
         source: "security@wordfence.com",
         tags: [
            "Patch",
         ],
         url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955",
      },
      {
         source: "security@wordfence.com",
         tags: [
            "Patch",
         ],
         url: "https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0",
      },
      {
         source: "security@wordfence.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cve",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cve",
      },
   ],
   sourceIdentifier: "security@wordfence.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2023-5049
Vulnerability from cvelistv5
Published
2023-10-30 13:49
Modified
2025-02-05 18:55
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Summary
The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cve
https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796
https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955
https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0
Impacted products
Vendor Product Version
smub Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Version: *   ≤ 1.12.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T07:44:53.704Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cve",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-5049",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-05T18:20:59.379686Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-05T18:55:08.982Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers",
               vendor: "smub",
               versions: [
                  {
                     lessThanOrEqual: "1.12.0",
                     status: "affected",
                     version: "*",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Lana Codes",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-30T13:49:00.238Z",
            orgId: "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
            shortName: "Wordfence",
         },
         references: [
            {
               url: "https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=cve",
            },
            {
               url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L796",
            },
            {
               url: "https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.11.4/app/rafflepress.php#L955",
            },
            {
               url: "https://plugins.trac.wordpress.org/changeset/2976620/rafflepress#file0",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2023-09-16T00:00:00.000+00:00",
               value: "Discovered",
            },
            {
               lang: "en",
               time: "2023-09-16T00:00:00.000+00:00",
               value: "Vendor Notified",
            },
            {
               lang: "en",
               time: "2023-10-29T00:00:00.000+00:00",
               value: "Disclosed",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
      assignerShortName: "Wordfence",
      cveId: "CVE-2023-5049",
      datePublished: "2023-10-30T13:49:00.238Z",
      dateReserved: "2023-09-18T14:00:12.932Z",
      dateUpdated: "2025-02-05T18:55:08.982Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-6887
Vulnerability from cvelistv5
Published
2024-09-12 06:00
Modified
2024-09-12 18:30
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Summary
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
References
https://wpscan.com/vulnerability/553806f4-da20-433c-8c19-35e6c87ccade/exploit, vdb-entry, technical-description
Impacted products
Vendor Product Version
Unknown Giveaways and Contests by RafflePress Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:rafflepress:giveaways_and_contests_by_rafflepress:*:*:*:*:*:wordpress:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "giveaways_and_contests_by_rafflepress",
                  vendor: "rafflepress",
                  versions: [
                     {
                        lessThan: "1.12.16",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 4.8,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "LOW",
                     integrityImpact: "LOW",
                     privilegesRequired: "HIGH",
                     scope: "CHANGED",
                     userInteraction: "REQUIRED",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-6887",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-12T18:28:24.462891Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-12T18:30:05.435Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Giveaways and Contests by RafflePress",
               vendor: "Unknown",
               versions: [
                  {
                     lessThan: "1.12.16",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Dmitrii Ignatyev",
            },
            {
               lang: "en",
               type: "coordinator",
               value: "WPScan",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Giveaways and Contests by RafflePress  WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-79 Cross-Site Scripting (XSS)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-09-12T06:00:04.189Z",
            orgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
            shortName: "WPScan",
         },
         references: [
            {
               tags: [
                  "exploit",
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://wpscan.com/vulnerability/553806f4-da20-433c-8c19-35e6c87ccade/",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSS",
         x_generator: {
            engine: "WPScan CVE Generator",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
      assignerShortName: "WPScan",
      cveId: "CVE-2024-6887",
      datePublished: "2024-09-12T06:00:04.189Z",
      dateReserved: "2024-07-18T19:01:31.012Z",
      dateUpdated: "2024-09-12T18:30:05.435Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-4745
Vulnerability from cvelistv5
Published
2024-06-10 08:09
Modified
2024-08-01 20:47
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.
References
https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cvevdb-entry
Impacted products
Vendor Product Version
RafflePress Giveaways and Contests by RafflePress Version: n/a   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-4745",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-06-11T00:50:46.772336Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-11T00:50:57.537Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T20:47:41.665Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://wordpress.org/plugins",
               defaultStatus: "unaffected",
               packageName: "rafflepress",
               product: "Giveaways and Contests by RafflePress",
               vendor: "RafflePress",
               versions: [
                  {
                     changes: [
                        {
                           at: "1.12.5",
                           status: "unaffected",
                        },
                     ],
                     lessThanOrEqual: "1.12.4",
                     status: "affected",
                     version: "n/a",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "Dhabaleshwar Das (Patchstack Alliance)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.<p>This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.</p>",
                  },
               ],
               value: "Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-862",
                     description: "CWE-862 Missing Authorization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-06-10T08:09:15.067Z",
            orgId: "21595511-bba5-4825-b968-b78d1f9984a3",
            shortName: "Patchstack",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
               ],
               url: "https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Update to 1.12.5 or a higher version.",
                  },
               ],
               value: "Update to 1.12.5 or a higher version.",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "WordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerability",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "21595511-bba5-4825-b968-b78d1f9984a3",
      assignerShortName: "Patchstack",
      cveId: "CVE-2024-4745",
      datePublished: "2024-06-10T08:09:15.067Z",
      dateReserved: "2024-05-10T11:15:29.855Z",
      dateUpdated: "2024-08-01T20:47:41.665Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}