Threats tagged 'ghsa-m49q-p734-466h'

The Photo Engine (Media Organizer & Lightroom) WordPress plugin versions up to and including 6.5.7 contain a stored cross-site scripting (XSS) vulnerability via the 'hierarchy[].name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with an authentication mechanism that relies solely on a user meta token without proper capability checks. This token is exposed on admin pages due to a commented-out guard, increasing the risk of exploitation.