CVE-2026-111971
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
| Vendor | unknown |
| Product | photo engine (media organizer & lightroom) |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown photo engine (media organizer & lightroom)
Be the first to know when new unknown vulnerabilities affecting unknown photo engine (media organizer & lightroom) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Photo Engine (Media Organizer & Lightroom)
0 < 6.5.8
References
Credits
Mahammad Mammadov WPScan