CVE-2015-9426: Manual Image Crop Project Manual Image Crop

Medium severity, CVSS 4.6. EPSS: 1% chance of exploitation in the next 30 days.

The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.

Affected products

• Manual Image Crop Project Manual Image Crop: before 1.11 (fixed in 1.11)

Published 2019-09-26. Last modified 2026-06-17.