The vulnerability arises from the lack of input sanitization and output escaping on the hierarchy[].name parameter in the Photo Engine Media Organizer & Lightroom plugin. Stored XSS data entered by an attacker is persisted and subsequently rendered on pages viewed by other users, allowing the attacker to execute scripts in the context of those users’ browsers. This can lead to session hijacking, credential theft, defacement, or other malicious actions.

WordPress sites running the Photo Engine (Media Organizer & Lightroom) plugin by tigroumeow, from all releases up to and including 6.5.7. Any installation of these versions is susceptible.

The CVSS score of 6.4 indicates medium severity. The EPSS score is not provided, but the vulnerability is accessible to authenticated users who can obtain the wplr_auth_token via the API endpoint – a token that is exposed on admin pages. Because Subscribers are common, the attack surface is significant, making exploitation plausible. The vulnerability is not listed in CISA KEV, but the combination of a medium CVSS and possible widespread exposure gives it a moderate risk profile.