CVE-2023-5049 in Giveaways and Contests Plugin
Summary
by MITRE • 10/30/2023
The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-5049 affects the Giveaways and Contests by RafflePress WordPress plugin, specifically targeting versions up to and including 1.12.0. This represents a critical security flaw that enables stored cross-site scripting attacks through the plugin's shortcode functionality. The vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, creating a pathway for malicious actors to inject persistent script code into the WordPress environment. The affected shortcodes 'rafflepress' and 'rafflepress_gutenberg' process user-supplied attributes without proper validation, allowing attackers to manipulate the 'giframe' attribute to execute malicious scripts across the affected website.
The technical exploitation of this vulnerability occurs through the manipulation of the 'giframe' attribute within the plugin's shortcode parameters. When authenticated attackers with contributor level permissions or higher submit malicious input through these attributes, the system fails to properly sanitize or escape the user-supplied data before rendering it in the web page context. This stored XSS vulnerability allows attackers to inject arbitrary JavaScript code that persists in the database and executes whenever any user accesses pages containing the compromised shortcode. The vulnerability specifically targets the plugin's handling of user input in the context of WordPress's shortcode processing system, where the lack of proper sanitization creates a persistent threat vector that can affect multiple users.
The operational impact of this vulnerability extends beyond simple script injection, as it provides attackers with the ability to perform various malicious activities within the compromised WordPress environment. Authenticated attackers with contributor privileges can leverage this vulnerability to execute scripts that may steal session cookies, redirect users to malicious sites, modify content, or even escalate privileges within the WordPress installation. The persistent nature of stored XSS means that the malicious scripts will execute automatically for any user who accesses pages containing the compromised shortcode, potentially affecting all website visitors. This vulnerability undermines the integrity and security of the entire WordPress installation, as it allows attackers to establish a foothold within the system that can be leveraged for further attacks.
Organizations affected by CVE-2023-5049 should immediately implement mitigations including updating to the latest version of the RafflePress plugin where the vulnerability has been addressed, implementing proper input validation measures, and conducting thorough security audits of all installed plugins. The vulnerability aligns with CWE-79, which describes Cross-site Scripting flaws in software systems, and represents a clear violation of secure coding practices that should be enforced through proper input sanitization and output escaping mechanisms. From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access through web application exploitation and can be used to establish persistent access within the compromised environment. Security teams should also consider implementing web application firewalls and monitoring for suspicious shortcode usage patterns to detect potential exploitation attempts and maintain defense in depth strategies against similar vulnerabilities.