CVE-2026-123667: falha de média gravidade em Photo Engine (Media Organizer & Lightroom)
Photo Engine < 6.6.2 - Author+ Stored XSS via Keyword Names
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Photo Engine (Media Organizer & Lightroom)CVEs relacionadas — Photo Engine (Media Organizer & Lightroom)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111971MEDIUMPhoto Engine < 6.5.8 - Author+ Stored XSS via Collection NameEPSS 0.3%CVE-2026-111972MEDIUMPhoto Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOREPSS 0.3%CVE-2026-115259MEDIUMPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOREPSS 0.2%CVE-2026-123666MEDIUMPhoto Engine < 6.6.2 - Author+ Media Deletion via Collection DeletionEPSS —