CVE-2026-111971

14th percentile - higher than 14% of all known CVEs

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

An author-level user can store a malicious script that executes in an administrator's browser, potentially leading to session hijacking or actions performed on behalf of the administrator.

Update the Photo Engine plugin to version 6.5.8 or later. Restrict author roles to trusted individuals and consider deploying a CSP policy.