Executive brief
A vulnerability exists in the BEAR plugin for WordPress, which is used by e-commerce sites to manage and bulk-edit WooCommerce products. An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to execute unauthorized scripts in the administrator's browser. This could lead to unauthorized changes to the website, theft of session information, or redirection of customers to malicious sites.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the BEAR (formerly WooCommerce Bulk Editor) plugin for WordPress in versions up to and including 1.1.8. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated attacker can exploit this by persuading a user (typically an administrator) to visit a specially crafted URL. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. The issue is resolved in version 1.1.9.
Affected products
- RealMag777 (PluginUs.Net) BEAR - WooCommerce Bulk Editor and Products Manager Professional <= 1.1.8
Timeline
- 2026-05-10: disclosed: Reported by Bonds to Patchstack
- 2026-06-29: advisory: NVD and Patchstack published the advisory
- 2026-06-29: patched: Version 1.1.9 released to address the vulnerability