WordPress Plugin Vulnerabilities

Photo Engine < 6.6.2 - Author+ Stored XSS via Keyword Names

Description

The plugin does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page.

Proof of Concept

Affects Plugins

Plugin icon
wplr-sync
Fixed in 6.6.2

References

CVE
CVE-2026-123667

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Aabideen Bangash
Submitter
Aabideen Bangash
Submitter website
https://www.linkedin.com/in/aabideen-bangash/
Verified
Yes
WPVDB ID
4dc2a8c5-9f1d-4bec-86fd-6d9b4aae5444

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2023-07-17
Title
WP Food Manager < 1.0.4 - Admin+ Stored XSS
Published
2026-06-17
Title
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter
Published
2021-09-20
Title
Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting
Published
2026-05-26
Title
Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2021-10-18
Title
Microsoft Clarity < 0.4 - Admin+ Stored Cross-Site Scripting