Photo Engine CVE-2026-111971

Requires a pre-authenticated account with the author role or above on the target WordPress site; the attacker supplies a crafted collection or gallery name that is stored without sanitisation/escaping. Execution is gated on user interaction: the injected script only fires when an administrator (or other privileged user) subsequently views the administrative dashboard where the name is rendered. Exploitation is limited to installations of Photo Engine (Media Organizer & Lightroom) before version 6.5.8 and to sites that actually grant author-or-higher accounts to untrusted users; single-admin sites face little practical exposure.

This is a moderate-priority stored XSS (CWE-79) in a WordPress plugin, not a high-urgency emergency. Key signals point to limited real-world risk: exploitation requires an authenticated account at the author role or above (per the description), there is no CISA KEV listing, no EPSS probability was supplied, and the only exploit artifact is an unverified WPScan PoC reference. The vuln.today decision label is 'this_month', consistent with a patch-when-convenient rather than drop-everything posture. There is a notable conflict in the supplied signals: the input CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H (base 6.8), but PR:H contradicts the description, which only requires the lower-privileged author role (normally PR:L), and the S:U with C:H/I:H/A:H is atypically high for a stored XSS whose payload merely executes in an administrator's browser - verify the metrics with WPScan/NVD. Because the flaw requires a pre-authenticated low-trust user and administrator interaction, it is primarily a privilege-escalation path on multi-author sites rather than a mass-exploitable internet-facing bug.

On a multi-author WordPress site running Photo Engine before 6.5.8, a user holding the author role creates a collection or gallery whose name contains a malicious script payload. When an administrator later views the affected administrative dashboard, the stored script executes in the admin's authenticated browser session, enabling account takeover or further privilege escalation. A public PoC reference exists (WPScan) but it is not verified as working exploit code.