Contests by Rewards Fuel
Contests by Rewards Fuel has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 3 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).
Every one of the 3 issues recorded for Contests by Rewards Fuel has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, most of them (2) reported by Sean Bales. Contests by Rewards Fuel is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2024-12513Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Contests by Rewards Fuel
Author
Rewards Fuel
Contests by Rewards Fuel connects your WordPress site to the Rewards Fuel platform. Use this plugin to embed live contests on any post or page. Create contests, entry methods, prizes, and rules in the Rewards Fuel web dashboard — the plugin handles connection and embedding. What this plugin does Connect your site with an API key from Account → WordPress Integration in the dashboard View your contests inside WordPress admin → Rewards Fuel Copy a shortcode or use the Rewards Fuel Contest Gutenberg block Embed the contest widget on posts, pages, and most themes Link out to the dashboard to edit contests, view stats, and pick winners What you build in Rewards Fuel (not inside WordPress) Contest schedule, rules, prizes, and appearance Entry methods (social actions, newsletter signup, questions, referrals, and more — by plan) Hosted contest page at r-f.page or embed on your own site Statistics, CSV export, winner selection, and prize claim flow Popular entry methods Available entry methods depend on your plan. Examples include: Click to enter — simple one-click entry Newsletter signup — collect email addresses (with optional confirmation for newsletter entries) Refer a friend — bonus entries when friends enter via a share link Answer a question — collect feedback or quiz answers Visit a URL — drive traffic to a landing page Code word — entrants enter a secret phrase Social actions — Instagram, Facebook, X/Twitter, YouTube, TikTok, Reddit, LinkedIn, Discord, Telegram, Twitch, and more (link-based actions; availability varies by plan) Email list member — allow pre-approved emails on your contest list to enter File upload — photo or document submissions Platform features (dashboard) Physical and digital prizes — upload digital prize files; winners claim online Geo restrictions — block selected countries from entering Bot protection — optional Cloudflare Turnstile per contest Custom appearance — colors, fonts, backgrounds, and widget wording 11 widget languages — English, Spanish, French, German, Portuguese, Italian, Dutch, Polish, Japanese, Korean, and Simplified Chinese Contest statistics — entries, methods, countries, traffic, referrers, device breakdown, and entrant summaries CSV export — download confirmed entrants from the dashboard Winner tools — random or manual winner selection; optional auto-pick and winner notification emails when the contest ends Scheduled draws — weekly, daily, or end-of-contest prize draws while live Copy a contest — duplicate setup for your next campaign Embed on WordPress After connecting your API key, embed any contest with: [rewardsfuel id="YOUR_CONTEST_REF"] Legacy shortcodes still work: [rf_contest id="123"] Or add the Rewards Fuel Contest block in the block editor. Pricing Rewards Fuel offers a free tier plus paid plans with more entry methods and stats. All paid plans include unlimited contests and entries. See current pricing at rewardsfuel.com/pricing. Get started Create a free account Create a contest in the dashboard Generate an API key under Account → WordPress Integration In WordPress: Rewards Fuel → Your account → paste your key Copy the shortcode from Rewards Fuel → Contests into any post or page Questions? Email info@rewardsfuel.com. Translations Widget copy supports 11 languages (configured per contest in the dashboard). The WordPress plugin admin UI is English.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C