CVE-2026-111971: Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Author role or a higher-privileged role can exploit it by supplying malicious script content in a collection or gallery name.
Where is the malicious content executed?
The affected plugin stores the supplied name and later outputs it in an administrative dashboard, where the stored script can execute.
Are sites affected if untrusted users cannot create collections or galleries?
The described attack requires an authenticated Author-level or higher user to provide a collection or gallery name. Restricting those capabilities to trusted accounts reduces exposure until the plugin is updated.