Final Tiles Grid CVE-2026-4559

Exploitation requires the attacker to hold at minimum Contributor-level WordPress access (PR:L per CVSS vector), confirmed by the CVE description. The Image Photo Gallery Final Tiles Grid plugin must be installed and active on the target site, and the attacker must be able to publish or edit posts that use the plugin's shortcode. The injected payload fires passively when any user visits the affected page - no further attacker-controlled interaction is needed. Limiting factors: sites with closed user registration, vetted contributor pools, or capabilities that prevent untrusted users from publishing shortcodes significantly reduce exploitability. No exploitation of default-configuration sites by unauthenticated attackers is possible.

The CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a Changed scope - the payload escapes the contributor's permission boundary and executes in victims' browsers - but the PR:L requirement to hold Contributor-level access is a meaningful barrier. The UI:N rating is debatable for stored XSS: while no attacker-crafted link is needed, a victim must still browse to the injected page, which some analysts would score UI:R (yielding a 5.4 base). No KEV listing and no public exploit code are identified, and no EPSS data was provided, so real-world exploitation probability cannot be independently quantified. The practical risk is elevated if a WordPress site permits open contributor registration, as this lowers the barrier to obtaining the required access. Against sites with closed or vetted contributor pools, the risk is materially lower than the CVSS score implies.

An attacker who registers as or compromises a Contributor account on the target WordPress site creates or edits a post containing a Final Tiles Grid shortcode with a malicious script injected into the 'delay' attribute. When any authenticated user - including an administrator - loads the page, the script executes in their browser, allowing the attacker to steal session cookies and escalate to full site takeover. No public proof-of-concept code has been identified at time of analysis.