photo_engine_media_organizer_lightroom vulnerabilities
CVEs whose affected-version data names the photo_engine_media_organizer_lightroom package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-115259Medium· 4.9Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it …
CVE-2026-111972Medium· 4.9Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitra…
CVE-2026-111971Medium· 6.8Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users w…
CVE-2026-107770Medium· 6.8The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform a…
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform a…