CVE-2026-107178: Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Image Photo Gallery Final Tiles Gridto a version that resolves this vulnerability.Fixed in 3.6.16
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the stored payload?
A user with contributor-level access or higher can store malicious JavaScript in gallery lightbox configuration values. The script runs in the browser of anyone viewing a page that embeds the affected gallery, including administrators.
Which plugin versions are affected?
Versions of Image Photo Gallery Final Tiles Grid earlier than 3.6.16 are affected. Version 3.6.16 is the first version identified as not affected by this issue.
Where is the malicious script executed?
The plugin prints unescaped gallery lightbox configuration values into an inline script on every page that embeds the gallery. A stored payload therefore executes when a visitor loads an affected gallery page.