Live › vulnerability › CVE-2026-120575
The Photo Engine (Media Organizer and Lightroom) WordPress plugin up to and including 6.5.7 does not sanitize the 'hierarchy[].name' parameter. An authenticated subscriber can store a script that runs in the browser of any user who opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running the Photo Engine WordPress plugin up to and including 6.5.7. The sources say an account with subscriber-level access or above is needed to inject the script, and the plugin's sync endpoint exposes the token that makes this possible on admin pages. Sites without this plugin are not affected.
No product ranges from the sources yet.
6.5.7 are listed as vulnerable.6.5.7; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.
This page as .md · .json · in your agent: get_signal("CVE-2026-120575")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.