Plugin icon

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)

woo-bulk-editor

Vulnerabilities:

27

Last Updated:

October 13, 2026

Active Installs:

30000

Published
Title
Fixed in
CVSS
Published
2026-10-04
Title
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.3 - Missing Authorization
Fixed in
Fixed in 1.2.3
CVSS
5.3 (medium)
Published
2026-09-10
Title
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF
Fixed in
Fixed in 1.2.2
CVSS
4.3 (medium)
Published
2026-09-10
Title
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF
Fixed in
Fixed in 1.2.2
CVSS
6.5 (medium)
Published
2026-09-10
Title
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR
Fixed in
Fixed in 1.2.2
CVSS
2.2 (low)
Published
2026-06-29
Title
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net < 1.1.9 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.9
CVSS
7.2 (high)
Published
2026-05-07
Title
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net < 1.1.6 - Cross-Site Request Forgery
Fixed in
Fixed in 1.1.6
CVSS
4.3 (medium)
Published
2026-04-07
Title
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net < 1.1.6 - Cross-Site Request Forgery to Product Data Modification
Fixed in
Fixed in 1.1.6
CVSS
6.5 (medium)
Published
2026-04-07
Title
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net < 1.1.6 - Cross-Site Request Forgery to Taxonomy Term Deletion
Fixed in
Fixed in 1.1.6
CVSS
4.3 (medium)
Published
2026-03-30
Title
BEAR < 1.1.8 - Authenticated (Shop manager+) SQL Injection
Fixed in
Fixed in 1.1.8
CVSS
4.9 (medium)
Published
2025-02-14
Title
BEAR < 1.1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.1.4.5
CVSS
5.5 (medium)
Published
2024-04-10
Title
BEAR <= 1.1.4.1 & WOLF <= 1.0.8.1 - Cross-Site Request Forgery to Notice Dismissal
Fixed in
Fixed in 1.1.4.2
CVSS
5.3 (medium)
Published
2024-03-28
Title
BEAR < 1.1.4.4 - Missing Authorization
Fixed in
Fixed in 1.1.4.4
CVSS
5.3 (medium)
Published
2024-03-26
Title
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net < 1.1.4.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.1.4.3
CVSS
6.1 (medium)
Published
2024-02-02
Title
BEAR < 1.1.4.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Plugin Options
Fixed in
Fixed in 1.1.4.1
CVSS
5.5 (medium)
Published
2024-02-02
Title
BEAR < 1.1.4.1 - Missing Authorization via Several Functions
Fixed in
Fixed in 1.1.4.1
CVSS
5.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
5.4 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
5.4 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
5.4 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-09-25
Title
BEAR for WordPress < 1.1.4 - Arbitrary Settings Update via CSRF
Fixed in
Fixed in 1.1.4
CVSS
4.3 (medium)
Published
2023-05-22
Title
BEAR < 1.1.3.2 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 1.1.3.2
CVSS
5.4 (medium)