WP Manifestindependent plugin directory
manifest / media / pro-media-cropper

Pro Media Cropper WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Precision cropping tool with advanced crop options and stock image search function.

★ 0stars
49release downloads
v4.0.6latest · 29d ago

Install

Download pro-media-cropper-4.0.6.zip From the v4.0.6 release on GitHub, Sep 24, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pjd199/pro-media-cropper/releases/download/v4.0.6/pro-media-cropper-4.0.6.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Pro Media Cropper is a high-precision image editing and cropping tool built natively for WordPress. It is designed for social media managers, photographers, and content creators who need to generate perfectly sized assets for YouTube, Instagram, X (Twitter), and Pinterest while maintaining automatic metadata and attribution tracking.


🚀 Key Features

  • Header-Integrated Actions: Quickly upload local files, browse the WordPress Media Library, or search stock image databases directly from the page header.
  • Intelligent Pillarboxing:
    • Echo Blur: Automatically creates a blurred, darkened background using the source image for vertical content.
    • Custom Colors: Use a built-in eyedropper to pick colors directly from your preview for a seamless background.
  • Vector & Document Support: Native support for rendering and cropping SVG and PDF files via PDF.js.
  • Metadata Tracking: Automatically carries over author and license information from stock providers into the WordPress Media Library description.
  • Modern Save UI: Save directly to your library with a single click inside the filename bar.

🛠 Installation

  1. Download the pro-media-cropper zip file from the asset list of the latest release on GitHub.
  2. In your WordPress Admin, go to Plugins > Add New > Upload Plugin.
  3. Upload the pro-media-cropper zip file and click Install Now.
  4. Activate the plugin.
  5. Access the tool via Media > Pro Media Cropper.

🔑 Setting Up API Keys

To use the "Search Stock Images" feature, enter your keys in Settings > Pro Media Cropper.

Provider Where to get the key
Pixabay Pixabay API Docs (Search for "Your API key")
Unsplash Unsplash Developers (Create a New Application)
Pexels Pexels API Page (Click "Get Started")

🎨 Customizing Aspect Ratios

The plugin comes pre-loaded with standard social media sizes. However, you can define your own "Custom Settings" dimensions to match your specific brand or website theme.

  1. Navigate to Settings > Pro Media Cropper.
  2. Locate Custom Dimensions (px).
  3. Enter your required Width and Height (e.g., 1200 x 628 for specific ad units).
  4. Save Changes.
  5. In the Cropper tool, select Custom Settings from the dropdown to use these dimensions.

💡 Usage Tips

  • Pillarbox Mode: If your image doesn't fit the chosen aspect ratio, toggle Pillarbox Mode. This allows you to fit the whole image on the canvas without stretching or cutting important details.
  • The Eyedropper: When using a "Custom" pillarbox style, click Pick and then click anywhere on your preview canvas to grab a specific hex code.
  • Search Cache: The plugin caches stock search results for 24 hours to keep the interface fast. You can manually wipe this cache in the Settings page if needed.

📜 License

This project is licensed under the MIT License.

Developed by: Pete Dibdin

Releases

Newest 25 of 42 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v4.0.6 latest
Sep 24, 2026 29d ago
pro-media-cropper-4.0.6.zip
3
Aug 14, 2026 2mo ago
pro-media-cropper-4.0.5.zip
3
Aug 14, 2026 2mo ago
pro-media-cropper-4.0.4.zip
1
Aug 14, 2026 2mo ago
pro-media-cropper-4.0.3.zip
1
May 24, 2026 5mo ago
pro-media-cropper-4.0.2.zip
1
May 13, 2026 5mo ago
pro-media-cropper-4.0.1.zip
1
May 11, 2026 5mo ago
pro-media-cropper-4.0.0.zip
7
May 10, 2026 5mo ago
pro-media-cropper-3.11.0.zip
2
Apr 20, 2026 6mo ago
pro-media-cropper-3.10.3.zip
1
Apr 20, 2026 6mo ago
pro-media-cropper-3.10.2.zip
0
Apr 20, 2026 6mo ago
pro-media-cropper-3.10.1.zip
0
Apr 20, 2026 6mo ago
pro-media-cropper-3.10.0.zip
2
Apr 15, 2026 6mo ago
pro-media-cropper-3.9.21.zip
1
Apr 15, 2026 6mo ago
pro-media-cropper-3.9.20.zip
1
Apr 8, 2026 6mo ago
pro-media-cropper-3.9.19.zip
1
Apr 8, 2026 6mo ago
pro-media-cropper-3.9.18.zip
2
Mar 20, 2026 7mo ago
pro-media-cropper-3.9.17.zip
4
Mar 20, 2026 7mo ago
pro-media-cropper-3.9.15.zip
0
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.14.zip
1
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.13.zip
0
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.12.zip
1
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.11.zip
1
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.10.zip
4
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.9.zip
0
Mar 11, 2026 7mo ago
pro-media-cropper-3.9.8.zip
1
All releases on GitHub →
D+ grade

Security

Pro Media Cropper 4.0.6 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
4.0.6
Findings
2
Worst severity
high
Content hash
bffaabc0b5b1b13cf2620cd1…

Findings

  • high SSRF via REST proxy-image for users with edit_posts

    ssrf

    POST /wp-json/pmc/v1/proxy-image is permission_callback current_user_can('edit_posts'). pmc_proxy_image_handler takes attacker-controlled url, calls wp_remote_get without host allowlist/block of private/link-local ranges, and writes the body to uploads/pmc-temp if Content-Type is image/*. A Contributor (or any edit_posts role) can use the site as an SSRF oracle against internal services and leave fetched content under a web-accessible path.

    admin/proxy-image.php:10-57

    Recommendation

    Restrict to upload_files or manage_options; allowlist stock-provider hosts only; block private/link-local/metadata IPs; do not expose cached files without auth if contents can be sensitive.

  • medium pmc_test_api AJAX missing capability check and nonce

    missing_capability

    wp_ajax_pmc_test_api is registered for all authenticated users with no check_ajax_referer and no current_user_can. Any Subscriber can POST provider+key and trigger wp_remote_get to Pixabay/Unsplash/Pexels (including Authorization header for Pexels), enabling CSRF from an admin session page and low-priv API probing.

    admin/settings.php:51-72

    Recommendation

    Require manage_options (or edit_posts matching settings) and check_ajax_referer before issuing outbound API tests.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.