What is GHSA-9949-jq7q-8g48?

GHSA-9949-jq7q-8g48 is a security advisory published by GitHub Security Advisories with Medium severity. The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly...

Which CVE IDs does GHSA-9949-jq7q-8g48 cover?

GHSA-9949-jq7q-8g48 covers the following CVE IDs: CVE-2026-97318. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9949-jq7q-8g48?

GHSA-9949-jq7q-8g48 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-9949-jq7q-8g48MediumCVSS 6.1

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-97318 →

📋 Description

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-97318
https://wpscan.com/vulnerability/a171b0f1-b2d2-4482-b44f-bd4a1f3b223b
https://github.com/advisories/GHSA-9949-jq7q-8g48