tigroumeow Photo Engine (Media Organizer & Lightroom)

• CVE-2026-120575 Medium 6.4 Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name 0.2%
• CVE-2026-107770 Medium 6.8 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action 0.5%