CVE-2024-10107: 
WordPress vulnerability analysis and mitigation

The Giveaways and Contests by RafflePress WordPress plugin before version 1.12.17 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-10107. The vulnerability was discovered and reported by Dmitrii Ignatyev, and it affects the plugin's settings functionality, particularly in multisite WordPress installations (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings, specifically affecting the GDPR text field in the Giveaway's Settings section. The issue has been assigned a CVSS v3.1 score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD, WPScan).

When exploited, this vulnerability enables high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, particularly significant in multisite WordPress installations where the unfiltered_html capability is typically restricted. This could potentially lead to client-side code execution in the context of other users' browsers (Wiz).

The vulnerability has been patched in version 1.12.17 of the RafflePress plugin. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).