EUVD-2026-100876
GHSA-vqqp-r8fg-8895
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor account on site
-
DeliveryInject JS into gallery config values
-
ExploitStored payload echoed into inline script
-
ExecutionAdmin views gallery page
-
PersistScript executes in admin session
-
ImpactHijack session or create admin user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at contributor level or above on the target site, and the plugin must have a gallery embedded on a page (the injected config values are echoed into that page's inline script). Exploitation is gated by two limiting factors: (1) the attacker must already possess a posting-capable account, so sites with no untrusted contributor/author users are not realistically exposed; and (2) UI:R - a victim such as an administrator must actually load the page containing the affected gallery for the stored payload to fire. No non-default plugin configuration is otherwise required beyond having the vulnerable version (<3.6.15) installed and a gallery published. |
| Impact | This is a moderate-priority, authenticated stored XSS (CWE-79) in a WordPress gallery plugin. Multiple signals agree it is NOT a widespread emergency: SSVC puts Exploitation at 'none' and Automatable at 'no', EPSS is very low (0.18%, 8th percentile), and it is absent from CISA KEV - so exploitation status is 'publicly available exploit code exists' (WPScan POC) but there is no evidence of active exploitation. The one elevated signal is SSVC Technical Impact 'total', consistent with the vendor CVSS C:H/I:H/A:H (6.8), reflecting that stored JavaScript executing in an administrator's browser can effectively hijack the admin session. A notable conflict: the CVSS vector lists PR:H (high privileges) yet the description requires only 'contributor-level access and above', which is a LOW-privilege authenticated role on WordPress - these disagree, and PR:H appears to overstate the barrier. Net real-world risk: meaningful on multi-author sites where untrusted contributors exist, but low on single-admin sites since the attacker must already hold a posting account; prioritize patching where contributor/author accounts are delegated. |
| Exploit ScenarioDerived | A user with contributor-level access on a multi-author WordPress site edits a gallery's configuration values, injecting JavaScript that is echoed unescaped into an inline script on every page embedding that gallery. When an administrator later previews or views the gallery, the script runs in their authenticated browser session, enabling session/cookie theft or admin-level actions. A public proof-of-concept is available via WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
RemediationAI
Vendor-released patch: 3.6.15 - update Image Photo Gallery Final Tiles Grid to version 3.6.15 or later from the WordPress plugin repository or the vendor's distribution channel, and verify the installed version after updating since plugin auto-updates can be blocked by host configuration; the WPScan advisory at https://wpscan.com/vulnerability/874eeea9-59a1-4ec0-b884-76d1bb6dba22/ should be used to confirm the fixed release. If the plugin cannot be updated immediately, deactivating it and removing any pages or posts that embed the gallery shortcode eliminates the sink entirely, with the trade-off that gallery functionality is lost on those pages; a narrower alternative is to strip the contributor role from untrusted users and audit existing contributor/author accounts, which removes the injection prerequisite but does not fix the underlying output-encoding flaw and leaves any already-stored payload live. Because exploitation is gated by UI:R, administrators should also avoid browsing untrusted gallery pages while a vulnerable version is installed, and consider temporarily removing the contributor capability or tightening registration/approval workflows. Sites that never enable the plugin and only have it installed can simply delete it. No non-default configuration changes are required to fix the issue - patching is sufficient and should be prioritized over the compensating controls above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-79 improper neutralization of input during web page generation, in its stored (persistent) form, affecting a WordPress plugin rather than WordPress core. Gallery configuration values - such as layout, lightbox, and caption options - are saved to the WordPress database and later rendered by the plugin into an inline <script> block on any front-end page containing the gallery shortcode, without output escaping or safe JSON encoding. Because the sink is a JavaScript context rather than HTML text, HTML-entity escaping alone would not be sufficient; the missing control is context-appropriate encoding of the values before they are interpolated into script. The plugin is distributed through the WordPress.org ecosystem and identified in the CPE data as cpe:2.3:a:unknown:image_photo_gallery_final_tiles_grid (the vendor field is unpopulated in the supplied CPE, a common artifact of crowd-sourced WordPress CPE assignments). The assessed vector differs from the vendor/published one (which used PR:H and S:U): our assessment places the privilege requirement at PR:L, since contributor-level users are sufficient, and marks the scope as changed (S:C) because the malicious script executes on pages where other users, including higher-privileged ones, operate - the classic privilege-escalation path of stored XSS against WordPress admin sessions. Impact is bounded to C:L/I:L/A:N under our assessment, i.e. session/action manipulation rather than server compromise.
Know when Image Photo Gallery Final Tiles Grid gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor-level access is low-privilege authenticated (PR:L, not the vendor's PR:H); stored XSS fires only when a victim views the page (UI:R) and executes in their browser context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) le
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcod
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description fiel
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inj
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite,
Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allow
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged a
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administra
Exploit-DB