The Photo Engine plugin prior to version 6.5.8 does not sanitize or escape collection or gallery names before saving them and before rendering them in the administrative dashboard. This lack of validation permits an authenticated user with the author role or higher to insert malicious script code into a collection or gallery name. When other privileged users later view the dashboard, the stored script will execute in their browser context, creating a classic stored XSS vulnerability. The description does not detail broader consequences such as session hijacking or data exfiltration; those possibilities are inferred only by the nature of stored XSS and are therefore not asserted in this statement.

The affected product is the WordPress plugin named Photo Engine (Media Organizer & Lightroom). Any installation running any plugin version earlier than 6.5.8 is potentially vulnerable, regardless of the WordPress theme or other plugins. The vulnerability is specific to authenticated users possessing the author role or higher within the plugin’s administrative interface.

The flaw requires only an authenticated author‑level user to create or edit a collection or gallery name; no complex conditions or elevated privileges beyond those roles are necessary. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the lack of mitigations means that any privileged user who submits a malicious name will cause the malicious script to be rendered to other privileged users. The CVSS score of 6.8 indicates a moderate severity impact on confidentiality, integrity, and availability of the administrative interface. The attack vector is thus straightforward for users who can access the plugin’s backend.