CropRefine
CropRefine has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for CropRefine has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. CropRefine is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.3.23.
CVE-2025-52734CropRefine <= 1.2.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

CropRefine
Author
ERA404
Extends the WordPress Media Library to allow individual control over each media item size’s crop. For those particular about their imagery… WordPress’s Media Library already gives authors strong, intuitive organization over their web site’s images. But some users are a little more particular than others over the individual crop sizes of each media item. CropRefine is for the keen-eyed, visual types who want something fast and fastidious. CropRefine provides quick-links from the Media Library to refine each item. A full catalog of existing crops and sizes are made available for refinement. If you prefer a different/better thumbnail but want to leave the other sizes untouched, CropRefine gives you that level of granularity over your imagery. Packaged with cropper.js, adjusting a crop is a smooth, draggable, precise refinement experience. Iterative backups are stored alongside each adjustment, so nothing is ever lost—only gained! If a re-crop just won’t achieve the results you’re after, a quick-upload tool is also offered for each media item size, so that you can replace that (and only that) size. No additional database is needed, no exhaustive setup process, no hidden license costs.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C