CVE-2026-123667
Photo Engine < 6.6.2 - Author+ Stored XSS via Keyword Names
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.
| Vendor | unknown |
| Product | photo engine (media organizer & lightroom) |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown photo engine (media organizer & lightroom)
Be the first to know when new unknown vulnerabilities affecting unknown photo engine (media organizer & lightroom) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Photo Engine (Media Organizer & Lightroom)
0 < 6.6.2
References
Credits
Aabideen Bangash WPScan