Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-03
Wplr Sync - Security Vulnerability (CVE-2026-120575)
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed…
PLUGIN
Wplr Sync
CVE-2026-120575
Risk Score
Threat Entry
Updated 2026-06-17
Wplr Sync - Arbitrary File Upload (CVE-2026-32524)
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through
PLUGIN
Wplr Sync
CVE-2026-32524
Risk Score
Threat Entry
Updated 2026-06-17
Wplr Sync - Cross-Site Request Forgery (CSRF) (CVE-2025-54672)
Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/a through
PLUGIN
Wplr Sync
CVE-2025-54672
Risk Score