Photo Engine (Media Organizer & Lightroom)
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:photo_engine_(media_organizer_&_lightroom):*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Photo Engine (Media Organizer & Lightroom) (d22e0019-4775-58a6-9f99-4d13a9aa0fe4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111971 |
vulnerable | 2026-11-03 10:16:11.132200 |
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
Published: 2026-10-22T06:00:18.131Z
Updated: 2026-10-22T11:06:28.988Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111972 |
vulnerable | 2026-11-03 10:16:10.438193 |
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
Published: 2026-10-22T06:00:18.311Z
Updated: 2026-10-22T11:06:28.821Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115259 |
vulnerable | 2026-11-03 10:15:37.360951 |
Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
Published: 2026-10-29T06:00:26.186Z
Updated: 2026-10-29T10:56:05.733Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.