Ghostwire

CVE-2026-111971: The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and...

MEDIUM CVSS 6.8 Exploit Available

Published: October 22, 2026 | Last Modified: October 22, 2026

Description

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

Ghostwire Analysis — What This Means Practically

Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

wpscan.com/vulnerability/b1b9a655-6a1b-43d9-99ba-7734107465d6/
www.tenable.com/cve/CVE-2026-111971
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-111971