Photo Engine EUVD-2026-115670

The attacker needs an authenticated subscriber-level (or higher) account on the target WordPress site; this is the primary limiting factor, so sites that disable open user registration substantially reduce exposure. The concrete exploitation path is specific to this plugin: the /?wplr-sync-api endpoint authenticates only via the wplr_auth_token usermeta and performs no capability check, and that token is disclosed on every admin page through localized script data because a screen-condition guard was commented out - allowing a subscriber to obtain the token and submit a malicious 'hierarchy[].name' value that is stored without sanitization or output escaping (CWE-79). Payload execution is deferred and requires a user (potentially an administrator) to later view the injected page; the stored script runs in that viewer's browser context. Affected: all versions up to and including 6.5.7; fixed in 6.5.8.

This is a real but moderate-priority issue, consistent with its 6.4 (Medium) CVSS and the 'this_month' decision label rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring only low privileges and no victim interaction to inject, with a scope change (code executes in other users' browser context) and limited confidentiality/integrity impact. The notable risk amplifier is the privilege barrier being effectively lower than 'subscriber' implies: per the description, the /?wplr-sync-api endpoint authenticates solely via the wplr_auth_token usermeta with no capability check, and that token is leaked on every admin page through localized script data because a screen-condition guard was commented out - so any subscriber can reach a code path that would otherwise look higher-privilege. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, so there is no signal of active exploitation; exploitation status is 'no public exploit identified at time of analysis' (the supplied references are vendor threat-intel and WordPress plugin source-code links, not working exploit code). SSVC-style signals are not fully provided, but technical impact is partial and exploitation is not automatable in the mass-scan sense because an attacker needs a valid subscriber account on the target site. Overall: a legitimately exploitable stored XSS worth patching on a normal cycle, not a drop-everything emergency, and the risk rises for sites that permit open/self-registration of subscriber accounts.

An attacker registers or obtains a subscriber-level account on a WordPress site running Photo Engine (WP/LR Sync) ≤ 6.5.7, retrieves the wplr_auth_token exposed in admin-page localized script data, and calls the /?wplr-sync-api endpoint to submit a malicious 'hierarchy[].name' value containing a web script. The script is stored without sanitization and later executes in the browser of any user - including an administrator - who views the affected page, enabling session/credential theft or actions in that user's context. No public working exploit was identified at time of analysis, though the affected source lines are publicly visible in the plugin repository.