CVE-2026-123667 · Package
NO FIX YET · SEE WHAT TO DO
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 stores keyword names without sanitising or escaping them and prints them on its debugging page. An author-level user can plant script that runs in the browser of an administrator who has enabled that page.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Photo Engine WordPress plugin before 6.6.2 where the debugging page is enabled and authors can add keywords. Sites without the plugin, or with it updated or the debugging page disabled, are not exposed to this flaw as described.
Not affected if debug-page-disabled, no-author-accounts, plugin-updated
Who cares photo-engine, wordpress
6.6.2.6.6.2 or later, per the description.The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.