Stored XSS in Photo Engine WordPress Plugin

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Photo Engine WordPress plugin before version 6.6.2. It occurs because the plugin does not properly sanitize or escape keyword names before storing them and displaying them on the debugging page. This allows users with Author role or higher to inject malicious scripts that execute when administrators view the debugging page.

Useful 0 Not Useful 0

Detection Guidance

Check if the Photo Engine WordPress plugin version is below 6.6.2. Inspect the debugging page for unsanitized keyword names that may contain malicious scripts. Look for unusual script tags or payloads in stored keywords.

Useful 0 Not Useful 0

Impact Analysis

Attackers with Author role or higher can inject malicious scripts that execute when administrators view the debugging page. This could lead to unauthorized actions, data theft, or session hijacking for administrators. The impact depends on the administrator's privileges and the site's configuration.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Photo Engine plugin to version 6.6.2 or later immediately. Disable the debugging page if not needed. Review user roles to ensure only trusted users have Author or higher privileges.

Useful 0 Not Useful 0