Manual Image Crop < 1.15 - Authenticated (Subscriber+) Insecure Direct Object Reference
medium
The Manual Image Crop plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 1.15. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 1.15
- Fixed in:
- 1.15
- Disclosed:
- Aug 20, 2026
CVE-2026-15384 on NVD →
Manual Image Crop <= 1.10 - Reflected Cross-Site Scripting
medium
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
- CVSS:
- 6.1
- Affected:
- up to 1.11
- Fixed in:
- 1.11
- Disclosed:
- Aug 24, 2015
CVE-2015-9426 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database