WP Spell Check vulnerabilities

Products

• WP Spell Check 4

Latest WP Spell Check CVEs

Newest publication first

1. CVE-2026-100506 WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

   Published 2026-10-05

   High·CVSS 7.2 EPSS 0.36%

   Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.

2. CVE-2025-25111 WordPress WP Spell Check plugin <= 9.21 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-02-07

   Medium·CVSS 5.4 EPSS 0.18%

   Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through <= 9.21.

3. CVE-2024-22143 WordPress WP Spell Check Plugin <= 9.17 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2024-01-31

   High·CVSS 8.8 EPSS 0.21%

   Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17.

4. CVE-2019-6027 WP Spell Check <= 7.1.9 - Cross-Site Request Forgery

   Published 2019-12-26

   High·CVSS 8.8 EPSS 0.68%

   Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.