CVE-2025-12484 is a stored cross-site scripting vulnerability in the Giveaways and Contests by RafflePress WordPress plugin (versions up to 1.12.19). The issue stems from insufficient input sanitization and output escaping of social media username parameters, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is rated with a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and partial confidentiality and integrity impact without availability impact.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the browsers of users visiting affected pages. This can lead to partial confidentiality and integrity compromise, such as theft of user session data or manipulation of page content. There is no direct impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Avoid using untrusted input in social media username fields and monitor for suspicious activity related to the plugin.