https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 23:02:43 +0000 https://db.gcve.eu/vuln/cve-2026-120575 <p><strong>Affected:</strong> tigroumeow Photo Engine (Media Organizer &amp; Lightroom)</p> <p>The Photo Engine (Media Organizer &amp; Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;hierarchy[].name&#39; parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user&#39;s token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.</p> <p><strong>Affected:</strong> tigroumeow Photo Engine (Media Organizer &amp; Lightroom)</p> <p>The Photo Engine (Media Organizer &amp; Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;hierarchy[].name&#39; parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user&#39;s token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.</p> https://db.gcve.eu/vuln/cve-2026-120575