{"id":"CVE-2026-120575","kind":"vulnerability","aliases":["CVE-2026-120575"],"related":[],"title":"Photo Engine WordPress plugin: stored XSS via hierarchy name parameter","description":"The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.","summary":"The Photo Engine (Media Organizer and Lightroom) WordPress plugin up to and including 6.5.7 does not sanitize the 'hierarchy[].name' parameter. An authenticated subscriber can store a script that runs in the browser of any user who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photo-engine","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","plugin-version-above-6.5.7"],"how_to_check":"- Check the installed Photo Engine plugin version in the WordPress admin plugins list; versions up to and including `6.5.7` are listed as vulnerable.\n- Review which accounts have subscriber-level access on the site.","fix":"- Move the Photo Engine plugin to a version later than `6.5.7`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:54+00:00","updated_at":"2026-11-03T05:49:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T05:49:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Photo Engine plugin to a version later than `6.5.7`; the sources do not name the fixed version.","reach":"internet","title":"Photo Engine WordPress plugin: stored XSS via hierarchy name parameter","impact":"medium","summary":"The Photo Engine (Media Organizer and Lightroom) WordPress plugin up to and including 6.5.7 does not sanitize the 'hierarchy[].name' parameter. An authenticated subscriber can store a script that runs in the browser of any user who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","photo-engine"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in other users' browsers, enabling session theft or actions","analyst_note":"Confirm the first fixed version of Photo Engine from the NVD entry or the plugin's changelog, since the sources give only the affected range.","how_to_check":"- Check the installed Photo Engine plugin version in the WordPress admin plugins list; versions up to and including `6.5.7` are listed as vulnerable.\n- Review which accounts have subscriber-level access on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-6.5.7"],"who_is_affected":"Sites running the Photo Engine WordPress plugin up to and including 6.5.7. The sources say an account with subscriber-level access or above is needed to inject the script, and the plugin's sync endpoint exposes the token that makes this possible on admin pages. Sites without this plugin are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4284,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120575':13A,16A '-2026':12A,15A '6.5.7':38B,95C 'access':115C,131C 'admin':168C 'api':145C 'arbitrari':120C 'attack':110C 'auth':151C 'authent':47B,109C,147C 'browser':57B 'capabl':156C 'check':157C 'comment':178C 'commented-out':177C 'condit':182C 'cross':80C 'cross-sit':79C 'current':160C 'cve':11A,14A 'data':173C 'due':96C,174C 'endpoint':146C 'engin':2A,20B,27B,68C 'escap':103C 'everi':167C 'execut':127C 'exploit':137C 'expos':165C 'guard':183C 'hierarchi':8A,43B,85C 'includ':37B,94C 'inject':64B,119C,133C 'input':99C 'insuffici':98C 'level':114C 'lightroom':31B,71C 'local':171C 'make':105C 'media':28B,69C 'name':9A,44B,86C 'open':62B 'organ':29B,70C 'output':102C 'packag':17B 'page':65B,124C,134C,169C 'paramet':10A,45B,87C 'photo':1A,19B,26B,67C 'photo-engin':18B 'plugin':4A,24B,33B,72C 'possibl':107C 'run':54B 'sanit':41B,100C 'screen':181C 'screen-condit':180C 'script':52B,82C,122C,172C 'site':81C 'sole':148C 'store':5A,50B,78C 'subscrib':48B,113C,139C 'subscriber-level':112C 'sync':144C 'token':152C,163C 'user':60B,130C,161C 'usermeta':153C 'version':90C 'via':7A,83C,149C,170C 'vulner':76C 'web':121C 'whenev':128C 'wordpress':3A,21B,23B,32B,74C 'wordpress-plugin':22B 'wplr':143C,150C 'wplr-sync-api':142C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Engine WordPress plugin up to and including 6.5.7. The sources say an account with subscriber-level access or above is needed to inject the script, and the plugin's sync endpoint exposes the token that makes this possible on admin pages. Sites without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","photoengine","wordpress","wordpressplugins"],"first_public_at":"2026-11-03T05:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120575","severity":null,"published_at":"2026-11-03T05:18:34+00:00","modified_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}