The vulnerability is a reflected cross‑site scripting flaw that stems from improper sanitization of user input when the Run Contests, Raffles, and Giveaways with ContestsWP plugin processes request parameters during web page generation. An attacker can inject and execute arbitrary JavaScript in the victim’s browser, potentially leading to theft of session cookies, credential hijacking, defacement or the delivery of further malware. The compromise is confined to the scope of the web application that uses the plugin and can affect anyone who visits the page containing the vulnerable parameter.

The flaw exists in the WordPress plugin Run Contests, Raffles, and Giveaways with ContestsWP, versions starting from an unspecified initial release and continuing through version 2.1.1. The plugin is provided by the vendor mdedev and is commonly installed on WordPress sites that host contests, raffles or giveaways.

The reported CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1% suggests that, so far, exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog, implying no widely known, actively exploited instances as of the data available. The likely attack vector is the web application layer, where a maliciously crafted URL or input containing crafted JavaScript is reflected back to the user’s browser without proper encoding.