{"id":"CVE-2026-123667","kind":"vulnerability","aliases":["CVE-2026-123667"],"related":[],"title":"Photo Engine WordPress plugin: keyword names allow stored cross-site scripting","description":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 stores keyword names without sanitising or escaping them and prints them on its debugging page. An author-level user can plant script that runs in the browser of an administrator who has enabled that page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photo-engine","wordpress"],"not_affected_if":["debug-page-disabled","no-author-accounts","plugin-updated"],"how_to_check":"- Check the installed version of the Photo Engine plugin in the WordPress admin under Plugins; affected if below `6.6.2`.\n- Check whether the plugin's debugging page is enabled in its settings.","fix":"- Photo Engine (WordPress plugin): `6.6.2` or later, per the description.","status":"open","published_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","triaged_at":"2026-11-11T06:27:19+00:00","updated_at":"2026-11-11T06:27:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T06:27:19Z","model":"claude-haiku-5-5","output":{"fix":"- Photo Engine (WordPress plugin): `6.6.2` or later, per the description.","reach":"network","title":"Photo Engine WordPress plugin: keyword names allow stored cross-site scripting","impact":"medium","summary":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 stores keyword names without sanitising or escaping them and prints them on its debugging page. An author-level user can plant script that runs in the browser of an administrator who has enabled that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","photo-engine"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Admin browser runs attacker script, enabling account takeover on the site","analyst_note":"","how_to_check":"- Check the installed version of the Photo Engine plugin in the WordPress admin under Plugins; affected if below `6.6.2`.\n- Check whether the plugin's debugging page is enabled in its settings.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-updated","debug-page-disabled","no-author-accounts"],"who_is_affected":"Sites running the Photo Engine WordPress plugin before 6.6.2 where the debugging page is enabled and authors can add keywords. Sites without the plugin, or with it updated or the debugging page disabled, are not exposed to this flaw as described.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4564,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123667':15A,18A '-2026':14A,17A '6.6.2':33B,79C 'administr':64B,114C 'allow':7A,97C 'attack':112C 'author':51B,101C 'author-level':50B 'browser':61B 'cross':10A,109C 'cross-sit':9A,108C 'cve':13A,16A 'debug':47B,95C 'enabl':67B,117C 'engin':2A,22B,26B,72C 'escap':40B,84C 'keyword':5A,35B,85C 'level':52B 'lightroom':29B,75C 'media':27B,73C 'name':6A,36B,86C 'organ':28B,74C 'output':91C 'packag':19B 'page':48B,69B,96C,119C 'perform':106C 'photo':1A,21B,25B,71C 'photo-engin':20B 'plant':55B 'plugin':4A,31B,77C 'print':43B 'role':102C 'run':58B 'sanitis':38B,82C 'script':12A,56B,111C 'site':11A,110C 'store':8A,34B,88C,107C 'user':53B,98C 'without':37B 'wordpress':3A,23B,30B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Engine WordPress plugin before 6.6.2 where the debugging page is enabled and authors can add keywords. Sites without the plugin, or with it updated or the debugging page disabled, are not exposed to this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","photoengine","wordpress"],"campaign_type":null,"search_a":"'-123667':15A,18A '-2026':14A,17A 'allow':7A 'cross':10A 'cross-sit':9A 'cve':13A,16A 'engin':2A 'keyword':5A 'name':6A 'photo':1A 'plugin':4A 'script':12A 'site':11A 'store':8A 'wordpress':3A","search_b":"'6.6.2':33B 'administr':64B 'author':51B 'author-level':50B 'browser':61B 'debug':47B 'enabl':67B 'engin':22B,26B 'escap':40B 'keyword':35B 'level':52B 'lightroom':29B 'media':27B 'name':36B 'organ':28B 'packag':19B 'page':48B,69B 'photo':21B,25B 'photo-engin':20B 'plant':55B 'plugin':31B 'print':43B 'run':58B 'sanitis':38B 'script':56B 'store':34B 'user':53B 'without':37B 'wordpress':23B,30B","search_c":"'6.6.2':79C 'administr':114C 'allow':97C 'attack':112C 'author':101C 'cross':109C 'cross-sit':108C 'debug':95C 'enabl':117C 'engin':72C 'escap':84C 'keyword':85C 'lightroom':75C 'media':73C 'name':86C 'organ':74C 'output':91C 'page':96C,119C 'perform':106C 'photo':71C 'plugin':77C 'role':102C 'sanitis':82C 'script':111C 'site':110C 'store':88C,107C 'user':98C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123667","severity":null,"published_at":"2026-11-11T06:17:18+00:00","modified_at":"2026-11-11T06:17:18+00:00","first_seen_at":"2026-11-11T06:25:43+00:00","fetched_at":"2026-11-11T06:25:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}