CVE-2023-5049

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-504956.5NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().CVE-2023-50505.4The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due CVE-2023-50515.4The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in vers CVE-2023-50526.3vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could CVE-2023-50539.8Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.CVE-2023-50545.3The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and inclu CVE-2023-50559.8Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.CVE-2023-505505.4layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.CVE-2023-505595.5An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.CVE-2023-50564.1A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authentic CVE-2023-505639.8Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.CVE-2023-505648.8An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary