Scratch Win Giveaways For Website Facebook Vulnerabilities

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for u...

CVSS:

5.3

Affected:

up to 2.8.0

Fixed in:

2.9.0

Disclosed:

Feb 17, 2025

CVE-2024-13316 on NVD →

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it poss...

CVSS:

5.4

Affected:

up to 2.7.1

Fixed in:

2.8.0

Disclosed:

Jan 3, 2025

CVE-2024-12545 on NVD →

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output esc...

CVSS:

6.4

Affected:

up to 2.6.9

Fixed in:

2.7.0

Disclosed:

Dec 2, 2024

CVE-2024-11898 on NVD →