Wp Spell Check Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check allows Cross Site Request Forgery. This issue affects WP Spell Check: from n/a through 9.21.

Affected:

up to 9.21

Fix:

No patched version reported

Disclosed:

Feb 7, 2025

CVE-2025-25111 on NVD →

The WP Spell Check plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.21. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can tri...

CVSS:

4.3

Affected:

up to 9.21

Fixed in:

9.22

Disclosed:

Feb 3, 2025

CVE-2025-25111 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17.

Affected:

up to 9.18

Fixed in:

9.18

Disclosed:

Jan 31, 2024

CVE-2024-22143 on NVD →

The WP Spell Check plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.17. This is due to missing or incorrect nonce validation on the wpscx_admin_empty_render() function. This makes it possible for unauthenticated attackers to update an API key via a forged request...

CVSS:

4.3

Affected:

up to 9.17

Fixed in:

9.18

Disclosed:

Jan 12, 2024

CVE-2024-22143 on NVD →

The WP Spell Check plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.17. This is due to missing or incorrect nonce validation on the wpscx_admin_empty_render() function. This makes it possible for unauthenticated attackers to update an API key via a forged request...

Affected:

up to 9.18

Fixed in:

9.18

Disclosed:

Jan 12, 2024

[en] The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 9.13

Fixed in:

9.13

Disclosed:

Jan 16, 2023

CVE-2022-2658 on NVD →

The WP Spell Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in versions up to, and including, 9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scri...

CVSS:

5.5

Affected:

up to 9.12

Fixed in:

9.13

Disclosed:

Dec 23, 2022

CVE-2022-2658 on NVD →

The WP Spell Check plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.12. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete ignored words via a forged request granted they can trick a site administrator into performi...

CVSS:

5.4

Affected:

up to 9.12

Fixed in:

9.13

Disclosed:

Dec 23, 2022

The WP Spell Check plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.12. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete ignored words via a forged request granted they can trick a site administrator into performi...

Affected:

up to 9.13

Fixed in:

9.13

Disclosed:

Dec 23, 2022

Unauthenticated SQL injection (SQLi) vulnerability discovered in WordPress WP Spell Check plugin (versions <= 9.9).

Affected:

up to 9.10

Fixed in:

9.10

Disclosed:

Feb 4, 2022

The WP Spell Check plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ and 'wpsc-scan-tab' parameters in versions before 9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exe...

CVSS:

6.1

Affected:

up to 9.3

Fixed in:

9.3

Disclosed:

Oct 25, 2021

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress WP Spell Check plugin (versions <= 9.2).

Affected:

up to 9.3

Fixed in:

9.3

Disclosed:

Oct 25, 2021

The WP Spell Check plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ and 'wpsc-scan-tab' parameters in versions before 9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exe...

Affected:

up to 9.3

Fixed in:

9.3

Disclosed:

Oct 25, 2021

[en] Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Affected:

up to 7.1.10

Fixed in:

7.1.10

Disclosed:

Dec 26, 2019

CVE-2019-6027 on NVD →

Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS:

8.8

Affected:

up to 7.1.9

Fixed in:

7.1.10

Disclosed:

Nov 26, 2019

CVE-2019-6027 on NVD →

The plugin does not have CSRF check in place when deleting ignored words, allowing attacker to make a logged in admin delete them via a CSRF attack

Affected:

up to 9.13

Fixed in:

9.13

The plugin does not escape the page and wpsc-scan-tab parameters before outputting them back in attributes, leading Reflected Cross-Site Scripting issues

Affected:

up to 9.3

Fixed in:

9.3