What is the CVSS score of CVE-2026-57320?

CVE-2026-57320 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of BEAR are affected by CVE-2026-57320?

The WordPress plugin BEAR (WooCommerce Bulk Editor and Products Manager) versions 1.1.8 and earlier contain an unauthenticated cross-site scripting vulnerability that allows attackers to inject…

How to fix or mitigate CVE-2026-57320?

Within 24 hours: Disable the BEAR plugin immediately and audit access logs for indicators of compromise. Within 7 days: Contact Patchstack and BEAR vendor (realmag777) for patch availability status; evaluate alternative WooCommerce management plugins (e.g., WooCommerce Native Products Manager, Variation Swapper) as replacement candidates. Within 30 days: Complete migration to a patched alternative plugin or implement a Web Application Firewall (WAF) rule set specifically blocking BEAR XSS injection patterns if plugin removal is not operationally feasible.

BEAR CVE-2026-57320

EUVD-2026-40096 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-w5v2-p57c-3889

WordPress XSS Wordpress Plugin Bear Realmag777

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (PR:N, AV:N, AC:L) requiring victim interaction (UI:R); script runs in a different security scope (S:C) with limited browser-context C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:15 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.

AnalysisAI

Reflected/stored cross-site scripting in the WordPress plugin BEAR (realmag777's WooCommerce Bulk Editor and Products Manager, woo-bulk-editor) version 1.1.8 and earlier allows an unauthenticated remote attacker to inject malicious script that executes in a victim's browser when the victim is lured to interact with a crafted request. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation that requires user interaction and crosses a security scope boundary. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack.

Technical ContextAI

The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue in BEAR, a WordPress/WooCommerce administrative plugin authored by realmag777 (CPE cpe:2.3:a:realmag777:bear:*). XSS arises when user-controllable input is reflected into or stored in HTML output without proper encoding or sanitization, so the browser parses attacker-supplied data as executable script. The scope-changed (S:C) rating reflects that script executes in the trusted context of the WordPress site/admin session, a different security authority than the vulnerable component that emitted it. Because PR:N is set, the injection sink is reachable without authenticating to the plugin, though delivery still depends on getting a victim (often a logged-in administrator using this admin-facing tool) to trigger the payload.

RemediationAI

No vendor-released patch version is identified in the available data; the input states only that versions <= 1.1.8 are affected, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-bulk-editor/vulnerability/wordpress-bear-plugin-1-1-8-cross-site-scripting-xss-vulnerability) and upgrade to the first release above 1.1.8 once confirmed by realmag777. Until a confirmed fixed version is installed, reduce exposure by deactivating the BEAR plugin if it is not in active use (trade-off: bulk-editing functionality is lost), restricting access to the plugin's admin pages and any public-facing endpoints via web-server or firewall rules, and deploying a WAF/virtual-patch rule (Patchstack offers one) to filter XSS payloads against the affected parameters (trade-off: signature rules can be bypassed and may need tuning). Advise administrators not to follow untrusted links into the WordPress admin while logged in.