Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · woo-bulk-editor
BEAR
26 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 6, 2026Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.CVE-2026-95526 · affects up to 1.2.2 · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
Sep 12, 2026BEAR: Does not perform ownership checks on several handlers that return product data by a user-supplied identifierCVE-2026-84025 · fixed in 1.2.2 · reported by WPScanLow 2.2
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and private product metadata.
Sep 12, 2026BEAR: Does not verify a CSRF nonce before saving its meta field configurationCVE-2026-84024 · fixed in 1.2.2 · reported by WPScanMedium 4.3
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · fixed in 1.2.2 · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
Jun 29, 2026Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.CVE-2026-57320 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.
May 12, 2026BEAR: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-45213 · affects up to 1.1.7.1 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through <= 1.1.7.1.
May 7, 2026BEAR: Cross-Site Request Forgery (CSRF)CVE-2026-27415 · affects up to 1.1.5 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.
Apr 8, 2026BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Cross-Site Request ForgeryCVE-2026-1673 · affects up to 1.1.5 · reported by WordfenceMedium 4.3
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Cross-Site Request ForgeryCVE-2026-1672 · affects up to 1.1.5 · reported by WordfenceMedium 6.5
The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_redraw_table_row() function. This makes it possible for unauthenticated attackers to update WooCommerce product data including prices, descriptions, and other product fields via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2025BEAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26775 · affects up to 1.1.4.4 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR woo-bulk-editor allows Stored XSS.This issue affects BEAR: from n/a through <= 1.1.4.4.
Mar 29, 2024BEAR: Missing AuthorizationCVE-2024-30463 · affects up to 1.1.4.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.
Mar 28, 2024BEAR: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30200 · affects up to 1.1.4.2 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR allows Reflected XSS.This issue affects BEAR: from n/a through 1.1.4.2.
Mar 23, 2024BEAR: Missing AuthorizationCVE-2024-24835 · affects up to 1.1.4 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.
Feb 8, 2024BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24834 · affects up to 1.1.4 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net allows Stored XSS.This issue affects BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.
Oct 20, 2023BEAR: Missing AuthorizationCVE-2023-4941 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4926 · affects up to 1.1.3.3 · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Missing AuthorizationCVE-2023-4924 · affects up to 1.1.3.3 · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4923 · affects up to 1.1.3.3 · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Missing AuthorizationCVE-2023-4943 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4942 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4940 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4937 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4935 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4920 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2023BEAR: Missing AuthorizationCVE-2023-4938 · affects up to 1.1.3.3 · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.CVE-2023-33314 · fixed in 1.1.3.2 · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.