CVE Intelligence

Villatheme Lucky Wheel Giveaway vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Villatheme Lucky Wheel Giveaway: 1 record(s), with affected versions and fixes.

CVE-2025-14541 High · 7.2 CWE-94 Feb 10, 2026
Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags parameter. This is due to the plugin using PHP's eval() function on user-controlled input without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.