CVE-2026-115259

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

EUVD-2026-112630

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

CVE-2026-111971

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

CVE-2026-111972

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

WordPress Photo Engine (Media Organizer & Lightroom) plugin < 6.5.8 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Mahammad Mammadov in WordPress Plugin Photo Engine versions 6.5.8...

CVE-2026-111972 Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

CVE-2026-111971 Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

WordPress Photo Engine (Media Organizer & Lightroom) plugin < 6.5.8 - Author+ Arbitrary Attachment Deletion vulnerability

Author+ Arbitrary Attachment Deletion vulnerability discovered by Mahammad Mammadov in WordPress Plugin Photo Engine versions 6.5.8...

CVE-2026-111972 Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

EUVD-2026-108016

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

CVE-2026-111971 Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

CVE-2026-111971

The Photo Engine (Media Organizer & Lightroom) WordPress plugin, in versions prior to 6.5.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape collection and gallery names before they are stored and subsequently rendered within an ...

CVE-2026-111972

The Photo Engine (Media Organizer & Lightroom) WordPress plugin, in versions before 6.5.8 , contains an authorization bypass vulnerability. The plugin fails to verify if a user is authorized to act on a targeted media attachment. This allows authenticated users with the author role or higher to d...

EUVD-2026-108017

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

PT-2026-121272

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

PT-2026-121273

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users...

CVE-2026-107770

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions ¦6.5.6 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to permanently delete arbitrary media attachments using wp_delete_attach...

EUVD-2026-102787

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...