Live › vulnerability › CVE-2026-111971
Go to dashboardThe Photo Engine WordPress plugin before 6.5.8 does not sanitise or escape collection and gallery names before storing and displaying them in the admin dashboard. An author-role user can plant script that runs in the browser of any administrator who views those names.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Photo Engine plugin before 6.5.8 where users with the author role or higher can create collections or galleries. Sites without this plugin, or with it already at 6.5.8 or later, are not affected. Exposure is mainly a risk on multi-author sites where admins review the dashboard.
No product ranges from the sources yet.
wp plugin get photo-engine --field=version (slug assumed; confirm it).6.5.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-111971")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.