The Photo Engine plugin for WordPress, versions prior to 6.5.8, is vulnerable to an insecure direct object reference (IDOR) issue. This allows authenticated users with author-level access or higher to delete arbitrary media attachments, including those uploaded by other users and administrators. Site administrators and defenders using the Photo Engine plugin for WordPress should assess their exposure and [truncated]
The Photo Engine WordPress plugin, versions prior to 6.5.8, contains a stored cross-site scripting (XSS) vulnerability. This vulnerability allows authenticated users with the author role and above to store and output malicious collection and gallery names within the administrative dashboard. The vulnerability can lead to potential security breaches, allowing attackers to inject malicious scripts. Defender [truncated]
