CVE-2026-97318 — Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter

CVE-2026-97318

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter PUBLISHED

Description (CNA)

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

Affected (CNA)

Vendor / product	Versions
Unknown / Giveaways and Contests by RafflePress	affected 0 before 1.12.27

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a171b0f1-b2d2-4482-b44f-bd4a1f3b223b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.