CVE-2026-97318
Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
| Vendor | unknown |
| Product | giveaways and contests by rafflepress |
| Published | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown giveaways and contests by rafflepress
Be the first to know when new unknown vulnerabilities affecting unknown giveaways and contests by rafflepress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Giveaways and Contests by RafflePress
0 < 1.12.27
References
Credits
Dick Snel WPScan