The vulnerability occurs because the plugin fails to sanitize or escape several social media username input fields, enabling an attacker to store malicious JavaScript. When a page renders these fields the untrusted code runs in the context of any site visitor. Attackers could steal session cookies, deface content, or direct users to phishing sites. The weakness is documented as CWE‑79.

The affected product is the WordPress plugin Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers. All releases up to and including version 1.12.19 are vulnerable. No additional product versions have been listed as affected. Deployments must therefore verify the installed version and plan a remediation update.

The CVSS base score is 7.2, indicating a high impact and moderately complex exploitation. The EPSS score of less than 1 % shows that active exploitation is uncommon, and the defect is not in the CISA KEV catalog. Because the flaw is an unauthenticated stored XSS, an attacker only requires the ability to submit data through the exposed username fields; no other privilege or system access is necessary. If the site is publicly accessible, the risk can affect any visitor to the page that contains the injected content.