Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Photo Engine (Media Organizer & Lightroom) 6.5.8 Clear all filters
TI-2026-79201 CVE-2026-111972 · GHSA-47v3-4v4g-79h5

Photo Engine WordPress plugin lets authors delete other users' media

Priority LOW 22

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00251 Published 2026-10-22 Fixed in 6.5.8 CWE-639
TI-2026-79200 CVE-2026-111971 · GHSA-9g52-cg59-7f5p

Stored XSS in Photo Engine WordPress plugin via collection name

Priority LOW 32

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing auth…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00306 Published 2026-10-22 Fixed in 6.5.8 CWE-79