---
id: "CVE-2026-123667"
page: "https://infrastack.ai/live/CVE-2026-123667"
kind: "vulnerability"
aliases: ["CVE-2026-123667"]
title: "Photo Engine WordPress plugin: keyword names allow stored cross-site scripting"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "photo-engine", "wordpress"]
not_affected_if: ["debug-page-disabled", "no-author-accounts", "plugin-updated"]
published_at: "2026-11-11T06:17:18+00:00"
first_seen_at: "2026-11-11T06:25:43+00:00"
updated_at: "2026-11-11T06:27:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123667", "first_seen_at": "2026-11-11T06:25:43+00:00"}]
exploit_sources: []
---

# Photo Engine WordPress plugin: keyword names allow stored cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-123667 (this .md is for agents)

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 stores keyword names without sanitising or escaping them and prints them on its debugging page. An author-level user can plant script that runs in the browser of an administrator who has enabled that page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Photo Engine plugin in the WordPress admin under Plugins; affected if below `6.6.2`.
- Check whether the plugin's debugging page is enabled in its settings.

## Fix

- Photo Engine (WordPress plugin): `6.6.2` or later, per the description.

## Timeline

- 2026-11-11T06:25:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123667

## From the sources

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_