Final Tiles Grid CVE-2026-104646

Requires: (1) the plugin installed at a version before 3.6.14; (2) an authenticated attacker with contributor-level role or above; (3) insertion of the plugin's gallery shortcode with attacker-controlled gallery configuration values that are overridden through the shortcode and printed unsanitised into an inline script block; and critically (4) a higher-privileged user - such as an administrator previewing a pending submission - to view the post, satisfying UI:R. Notably, NO gallery ownership is required: any gallery already present on the site can be referenced. Limiting factors: the attacker must first hold a valid contributor account, and payload execution only occurs when a victim loads the post, so sites that do not accept untrusted contributor content or do not preview pending submissions face substantially lower risk.

This is a medium-severity stored XSS (CVSS 6.8, CWE-79) whose real-world risk is moderate and context-dependent rather than an urgent emergency. Key signals conflict: the supplied CVSS vector sets PR:H, but the description explicitly states 'contributor-level access and above', which is a LOW-privilege WordPress role - so the real privilege barrier is PR:L, not PR:H; this discrepancy should be verified and tends to make exploitation slightly EASIER than the raw vector implies. Exploitation also depends on UI:R: a higher-privileged user (e.g. an administrator) must view or preview the attacker's post, which is a realistic workflow on multi-author sites that use the contributor→pending-review model. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code is indicated, so there is no evidence of active exploitation. Net: a credible, patch-this-on-the-next-cycle issue for sites that accept untrusted contributor content, but not a drop-everything internet-wide threat, since it requires an authenticated foothold plus a privileged victim action.

On a multi-author WordPress site, an attacker registers or obtains a contributor account and creates a pending post containing the plugin's gallery shortcode with malicious JavaScript in overridable gallery configuration values, referencing any gallery that already exists. When an editor or administrator previews the pending submission, the injected script executes in their authenticated browser session, enabling admin session/cookie theft or creation of a rogue administrator. No public exploit code is identified at time of analysis, and the attack is network-based but low-complexity (AV:N/AC:L).