CVE-2026-97318: Unknown Giveaways And Contests By Rafflepress

Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

Affected products

• Unknown Giveaways And Contests By Rafflepress: before 1.12.27 (fixed in 1.12.27)

Published 2026-10-02. Last modified 2026-10-02.