CVE-2026-111971mediumCWE-79

CVE-2026-111971: medium-severity vulnerability in Photo Engine (Media Organizer & Lightroom)

Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name

Published

Follow this CVE+ Monitor Photo Engine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.3%
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Photo Engine (Media Organizer & Lightroom)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Photo Engine (Media Organizer & Lightroom)

In the same product, most dangerous first.

CVE-2026-111972MEDIUMPhoto Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOREPSS 0.3%CVE-2026-115259MEDIUMPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOREPSS 0.2%