Final Tiles Grid CVE-2026-104409

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) - typically a contributor/author or equivalent role able to submit gallery content - on a site running the Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite) plugin version 3.6.13 or earlier. The injected script does not execute until a victim (e.g., an administrator or site visitor) loads the page rendering the stored gallery input (UI:R), so a second human-interaction step is mandatory. Limiting factors: the attacker must already hold a valid low-privileged account (so sites that do not allow untrusted user registration or multi-author contributions are substantially less exposed), exploitation yields only limited confidentiality/integrity/availability impact in the victim's browser context rather than server compromise, and no special non-default plugin configuration is indicated by the available data beyond the plugin being installed and active.

This is a moderate-severity Stored XSS (CWE-79) in the WordPress plugin 'Image Photo Gallery Final Tiles Grid' (final-tiles-grid-gallery-lite) by WP Chill, scored CVSS 6.5 (Medium). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L) and victim interaction (UI:R), with a scope change (S:C) that is characteristic of stored XSS executing in another user's browser/security context. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - this is a typical authenticated stored XSS in a WordPress plugin rather than a pre-auth remote-code-execution emergency. Realistically this is a manage-on-patch-cycle issue, not a drop-everything priority: the requirement for an authenticated contributor/author-level account and for an administrator (or other user) to view the injected content meaningfully limits mass exploitation, though multi-author or open-registration sites face higher risk. Note: EPSS and KEV data are absent from the input (not confirmed low - simply not provided), so the low real-world-exploitation inference is based on the absence of POC/KEV signals rather than a confirmed-low EPSS value.

A low-privileged authenticated user (e.g., a contributor or author on a multi-user WordPress site) submits gallery content containing a malicious script payload through an input field that the plugin fails to properly sanitize. The payload is stored and later rendered when an administrator or other user views the affected gallery page in the dashboard or front end, executing attacker-controlled JavaScript in that victim's browser session. No public proof-of-concept was provided in the input, and exploitation requires both the authenticated injection step and victim interaction (UI:R).