Final Tiles Grid EUVD-2026-100889

Exploitation requires an authenticated account with contributor-level capabilities or higher (per the description), the ability to create/edit a gallery, and that the plugin version is below 3.6.16 with lightbox configuration in use. The payload is stored but inert until a victim - notably an administrator - loads a page embedding the affected gallery, so user interaction by the victim is mandatory (UI:R). Limiting factors: this is NOT remote-unauthenticated - it depends on sites that grant contributor+ accounts (multi-author sites, open or loosely-moderated registration); single-author or tightly-controlled sites have a far narrower exposure. The attack self-limits because execution only occurs when someone views the malicious gallery.

Signals point to a moderate, authentication-gated risk rather than an urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R, score 6.8) indicates network-reachable but privilege- and interaction-dependent exploitation, and the C:H/I:H/A:H impact flags appear inflated for a stored XSS - WPScan-class gallery XSS typically yields low integrity/confidentiality impact unless admin-session abuse is chained. There is a notable conflict between the vector's PR:H and the description, which states exploitation requires only 'contributor-level access and above'; contributor is a LOW-privilege WordPress role, so PR:L is the honest mapping - verify, as this changes the exploitability picture (a low bar for registration-open or multi-author sites). EPSS is low (0.20%, 9th percentile) and CISA SSVC records Exploitation: none and Automatable: no, which agrees with the absence of KEV listing and argues against mass, automated abuse. Countervailing signals: a public exploit exists (WPScan) and SSVC Technical Impact is 'total,' and the payload is specifically engineered to fire in an administrator's browser, enabling session/account takeover. Net: real but conditional - a second-order privilege-escalation risk on multi-author WordPress sites running the plugin, not a drop-everything emergency.

On a WordPress site that accepts contributor-or-higher accounts (e.g., a multi-author blog or one with open registration elevated to contributor), an attacker authenticates and embeds a gallery, injecting malicious JavaScript into the lightbox configuration values. When an administrator later previews or views any page embedding that gallery, the script executes in the admin's authenticated session, enabling actions such as creating a rogue admin or planting a backdoor. A public proof-of-concept is available via WPScan, lowering the effort to reproduce.