MEDIUMCVSS v3.1 6.8Vulnerability
CVE-2026-111971
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Epss score
- 0.00159
- Cvss severity
- MEDIUM
- Cvss score
- 6.8
- Retrieved at
- 2026-10-22T22:17:33+00:00
- Last source
- FIRST EPSS
- Score
- 6.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-111971
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-22T10:03:30+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-10-22T06:17:14.233
- Last modified
- 2026-10-22T15:16:14.027
- Epss percentile
- 0.04658
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph