CVE-2026-104646
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
Risk Assessment
JavaScript injection can lead to administrator session hijacking, data theft, or content modification. This can severely compromise the website's security.
Recommendation
Update the plugin to version 3.6.14 or later. Restrict user permissions to the minimum necessary.
Other vulnerabilities in Image Photo Gallery Final Tiles Grid
See all- CVE-2026-104645Low
The Image Photo Gallery Final Tiles Grid WordPress plugin before version 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write plugin metadata onto arbitrary posts they do not own.
- CVE-2026-104409Medium
Stored XSS vulnerability in Image Photo Gallery Final Tiles Grid plugin up to version 3.6.13. Allows injection of a persistent script that can execute in the user's browser.
- CVE-2026-4559Medium
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-27424Medium
The Image Photo Gallery Final Tiles Grid WordPress plugin up to version 3.6.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-39510Low
The WordPress plugin Image Photo Gallery Final Tiles Grid (versions up to 3.6.11) contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS