CVE-2026-123667: Photo Engine < 6.6.2 - Author+ Stored XSS via Keyword Names
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Photo Engine (Media Organizer & Lightroom) WordPress pluginto a version that resolves this vulnerability.Fixed in 6.6.2
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
An authenticated WordPress user with the Author role or a higher role can create a malicious keyword name. The stored script affects administrators who have enabled and visit the plugin's debugging page.
Is a default deployment necessarily exposed?
Exploitation depends on the plugin debugging page being enabled and an administrator viewing it. The provided information does not establish whether that page is enabled by default.
What can be done if upgrading is not immediately possible?
Disable the plugin debugging page to prevent the described administrator-facing trigger, and restrict untrusted users from holding the Author role or higher. Review existing keyword names for untrusted or suspicious content before re-enabling the page.
How can administrators check for existing exposure?
Check whether the Photo Engine debugging page is enabled and whether users with Author-or-higher privileges have created keyword names. Inspect stored keyword names for unexpected HTML or script-like content, since the issue is triggered when those names are displayed on the debugging page.