CVE-2026-104644: Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Image Photo Gallery Final Tiles Gridto a version that resolves this vulnerability.Fixed in 3.6.15
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
Any user with Contributor-level access or higher can store malicious JavaScript through gallery configuration updates. The script runs in the browser of anyone viewing a page that embeds the affected gallery, including administrators.
What conditions are required for exploitation?
The attacker needs an account with at least Contributor permissions and the ability to update gallery configuration values. A victim must then visit a page where the modified gallery is embedded.
Which versions are affected?
Versions of Image Photo Gallery Final Tiles Grid earlier than 3.6.15 are affected.