Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wplr-sync
Photo Engine
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not verify that a user is authorised to act on the targeted media attachmentCVE-2026-111972 · fixed in 6.5.8 · reported by WPScanMedium 4.9
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, including those uploaded by other users and administrators.
Oct 22, 2026Photo Engine (Media Organizer & Lightroom): Does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboardCVE-2026-111971 · fixed in 6.5.8 · reported by WPScanMedium 6.8
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.
Oct 16, 2026Photo Engine (Media Organizer & Lightroom): Authorization bypassCVE-2026-107770 · affects up to 6.5.6 · reported by WordfenceMedium 6.8
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026Photo Engine: Unrestricted Upload of File with Dangerous TypeCVE-2026-32524 · affects up to 6.4.9 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.
Aug 14, 2025Photo Engine: Cross-Site Request Forgery (CSRF)CVE-2025-54672 · affects up to 6.4.3 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/a through <= 6.4.3.
Nov 1, 2024Photo Engine: Missing AuthorizationCVE-2024-43332 · affects up to 6.4.0 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.
Aug 1, 2024Photo Engine: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39660 · affects up to 6.3.1 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jordy Meow Photo Engine allows Stored XSS.This issue affects Photo Engine: from n/a through 6.3.1.
Dec 20, 2023Photo Engine (Media Organizer & Lightroom): Authorization Bypass Through User-Controlled KeyCVE-2023-38513 · affects up to 6.2.5 · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.