Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-03
Photo Engine - Security Vulnerability (CVE-2026-120575)
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed…
PLUGIN
Photo Engine
CVE-2026-120575
Risk Score
Threat Entry
Updated 2026-06-17
Photo Engine - Broken Access Control (CVE-2024-43332)
Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.
PLUGIN
Photo Engine
CVE-2024-43332
Risk Score
Threat Entry
Updated 2026-06-17
Photo Engine - Broken Access Control (CVE-2023-38513)
Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
PLUGIN
Photo Engine
CVE-2023-38513
Risk Score