{"id":"CVE-2026-111971","kind":"vulnerability","aliases":["CVE-2026-111971"],"related":[],"title":"Photo Engine WordPress plugin: stored XSS via collection names in dashboard","description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.","summary":"The Photo Engine WordPress plugin before 6.5.8 does not sanitise or escape collection and gallery names before storing and displaying them in the admin dashboard. An author-role user can plant script that runs in the browser of any administrator who views those names.","severity":"medium","cvss":6.8,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-author-role-users","plugin-at-6.5.8-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get photo-engine --field=version` (slug assumed; confirm it).\n- Review collection and gallery names in the plugin's admin pages for unexpected HTML or script content.","fix":"- Update the Photo Engine (Media Organizer & Lightroom) plugin to `6.5.8` or later.\n- Until updated, restrict the author role or review collection names created by authors.","status":"open","published_at":"2026-10-22T06:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:42:50+00:00","updated_at":"2026-10-25T03:42:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Photo Engine (Media Organizer & Lightroom) plugin to `6.5.8` or later.\n- Until updated, restrict the author role or review collection names created by authors.","reach":"internet","title":"Photo Engine WordPress plugin: stored XSS via collection names in dashboard","impact":"medium","summary":"The Photo Engine WordPress plugin before 6.5.8 does not sanitise or escape collection and gallery names before storing and displaying them in the admin dashboard. An author-role user can plant script that runs in the browser of any administrator who views those names.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in an administrator's browser session, enabling account takeover.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get photo-engine --field=version` (slug assumed; confirm it).\n- Review collection and gallery names in the plugin's admin pages for unexpected HTML or script content.","needs_analyst":false,"not_affected_if":["plugin-at-6.5.8-or-later","no-author-role-users"],"who_is_affected":"Sites running the Photo Engine plugin before 6.5.8 where users with the author role or higher can create collections or galleries. Sites without this plugin, or with it already at 6.5.8 or later, are not affected. Exposure is mainly a risk on multi-author sites where admins review the dashboard.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3373,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111971':14A,17A '-2026':13A,16A '6.5.8':32B,80C 'admin':49B 'administr':66B,98C 'allow':100C 'attack':116C 'authent':101C 'author':53B,105C 'author-rol':52B 'browser':63B 'collect':8A,38B,86C 'cross':113C 'cross-sit':112C 'cve':12A,15A 'dashboard':11A,50B,99C 'display':45B 'engin':2A,28B,73C 'escap':37B,85C 'galleri':40B,88C 'host':21B 'lightroom':76C 'media':74C 'name':9A,41B,70B,89C 'organ':75C 'output':94C 'packag':18B 'perform':110C 'photo':1A,27B,72C 'plant':57B 'plugin':4A,25B,30B,78C 'role':54B,106C 'run':60B 'sanitis':35B,83C 'script':58B,115C 'self':20B 'self-host':19B 'site':114C 'store':5A,43B,91C,111C 'user':55B,102C 'via':7A 'view':68B 'wordpress':3A,22B,24B,29B,77C 'wordpress-plugin':23B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Engine plugin before 6.5.8 where users with the author role or higher can create collections or galleries. Sites without this plugin, or with it already at 6.5.8 or later, are not affected. Exposure is mainly a risk on multi-author sites where admins review the dashboard.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111971","severity":null,"published_at":"2026-10-22T06:17:14+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111971","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111971","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}