MEDIUMCVSS v3.1 6.4Vulnerability
CVE-2026-123667
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Epss score
- 0.00194
- Cvss severity
- MEDIUM
- Cvss score
- 6.4
- Retrieved at
- 2026-11-11T23:51:13+00:00
- Last source
- FIRST EPSS
- Score
- 6.4
- Cvss version
- 3.1
- Cve id
- CVE-2026-123667
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-11T07:36:44+00:00
- Name
- CVE-2026-123667
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-11-11T06:17:18.337
- Last modified
- 2026-11-11T12:19:43.110
- Epss percentile
- 0.09225
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph