CVE-2026-111971— Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
Quick assessment
Affected
Unknown Photo Engine (Media Organizer & Lightroom)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 6.5.8 版本之前，WordPress 插件 Photo Engine（包含 Media Organizer 和 Lightroom 功能）在存储和输出集合（collection）与画廊（gallery）名称时，未对其进行清理和转义处理。这允许拥有作者（author）角色或更高权限的已认证用户，在管理后台实施存储型跨站脚本（Stored XSS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111971
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
Source: CVE Program / CVE List V5
Vulnerability Description
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Photo Engine (Media Organizer & Lightroom) | 0 ~ 6.5.8 | - |
|
II. Public POCs for CVE-2026-111971
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111971
请登录查看更多情报信息。
Other References for CVE-2026-111971 (1)
-
https://wpscan.com/vulnerability/b1b9a655-6a1b-43d9-99ba-7734107465d6/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-22 · 13 CVEs total
| CVE-2026-97328 | WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser | |
| CVE-2026-88849 | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Stude | |
| CVE-2026-111972 | Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR | |
| CVE-2026-111958 | Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token | |
| CVE-2026-78392 | Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter | |
| CVE-2026-110011 | MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definitio | |
| CVE-2026-110010 | MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset v | |
| CVE-2026-103234 | WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Em | |
| CVE-2026-100142 | FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR | |
| CVE-2026-109931 | Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update | |
| CVE-2026-109927 | CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role | |
| CVE-2026-109987 | PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-97328
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alte -
CVE-2026-88849
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User -
CVE-2026-111972
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion -
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link T -
CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_tar
V. Comments for CVE-2026-111971
No comments yet