WordPress Plugin Vulnerabilities

WP Spell Check < 9.13 - Ignored Word Deletion via CSRF

Description

The plugin does not have CSRF check in place when deleting ignored words, allowing attacker to make a logged in admin delete them via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
wp-spell-check
Fixed in 9.13

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
1e17cca1-b24c-4620-bd88-b89c7c2fcad7

Timeline

Publicly Published
2022-12-23 (about 3 years ago)
Added
2022-12-26 (about 3 years ago)
Last Updated
2022-12-26 (about 3 years ago)

Other

Published
Title
Published
2023-08-21
Title
Herd Effects < 5.2.3 - Admin+ Stored XSS
Published
2014-08-01
Title
Mac Photo Gallery - Multiple Script Insertion Vulnerabilities
Published
2024-04-15
Title
Enhanced Media Library < 2.8.10 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2024-03-21
Title
Cards for Beaver Builder < 1.1.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link
Published
2025-04-24
Title
360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting