Stored Cross-Site Scripting Vulnerability in Photo Engine Plugin for WordPress

CVE-2026-120575

What is CVE-2026-120575?

The Photo Engine plugin for WordPress suffers from a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping in the 'hierarchy[].name' parameter. This security flaw allows attackers with subscriber-level access or higher to inject harmful scripts into web pages. The vulnerability arises because the /?wplr-sync-api endpoint uses a user's wplr_auth_token without proper capability checks, exposing the token on admin pages. As a result, this can lead to the execution of arbitrary scripts whenever a user accesses a compromised page.

References