Contests From Rewards Fuel Vulnerabilities

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 2.0.65

Fixed in:

2.0.66

Disclosed:

Dec 17, 2024

CVE-2024-12513 on NVD →

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVSS:

6.4

Affected:

up to 2.0.64

Fixed in:

2.0.65

Disclosed:

Mar 19, 2024

CVE-2024-1787 on NVD →

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject...

CVSS:

5.4

Affected:

up to 2.0.62

Fixed in:

2.0.63

Disclosed:

Mar 19, 2024

CVE-2024-1785 on NVD →