WP Spell Check < 9.13 - Admin+ Stored Cross-Site Scripting

2022-12-2300:00:00

Marco Nappi

word press spell check xss stored cross site scripting

0.001 Low

EPSS

Percentile

23.5%

JSON

The plugin does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Add a word to ignore (via /wp-admin/admin.php?page=wp-spellcheck-ignore.php) with the following payload: " style=animation-name:rotation onanimationstart=alert(/XSS/)// 

The XSS will be trigged each time the ignore dashboard is accessed

0.001 Low

EPSS

Percentile

23.5%

JSON

Related for WPEX-ID:E72FA040-3CA5-4570-9A3C-C704574B1CA3