---
id: "CVE-2026-111971"
kind: "vulnerability"
aliases: ["CVE-2026-111971"]
title: "Photo Engine WordPress plugin: stored XSS via collection names in dashboard"
severity: "medium"
cvss: 6.8
epss: 0.00235
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-author-role-users", "plugin-at-6.5.8-or-later"]
published_at: "2026-10-22T06:17:14+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:42:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111971", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111971", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Photo Engine WordPress plugin: stored XSS via collection names in dashboard

The Photo Engine WordPress plugin before 6.5.8 does not sanitise or escape collection and gallery names before storing and displaying them in the admin dashboard. An author-role user can plant script that runs in the browser of any administrator who views those names.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get photo-engine --field=version` (slug assumed; confirm it).
- Review collection and gallery names in the plugin's admin pages for unexpected HTML or script content.

## Fix

- Update the Photo Engine (Media Organizer & Lightroom) plugin to `6.5.8` or later.
- Until updated, restrict the author role or review collection names created by authors.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111971
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111971

## From the sources

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_