Image Photo Gallery Final Tiles Grid
Monthly
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) lets an authenticated user with contributor-level access or higher inject JavaScript via unescaped gallery lightbox configuration values, which is then printed into an inline script on every page that embeds the affected gallery. The payload is stored and inert until a victim - most critically an administrator - loads such a page, so successful abuse requires victim user interaction and yields code execution in that victim's browser, enabling session/token theft or privileged actions performed as the victim. Publicly available exploit code exists (per WPScan's disclosure), though the EPSS score is low at roughly 0.20 percent (9th percentile) and there is no confirmed active exploitation; risk is moderate and gated on sites granting contributor+ accounts to untrusted users.
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite, WP Chill) through version 3.6.13 lets an authenticated low-privileged user - a contributor, author, or equivalent role permitted to submit gallery content - inject script that is stored server-side and later rendered in the browser of any victim who views the affected gallery page, including administrators. Because the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5, Medium), successful exploitation requires a valid low-privileged account plus a second human interaction step (the victim loading the tainted page), and impact is confined to the victim's browser session rather than the underlying server. No public exploit code has been identified at time of analysis, and no CISA KEV entry indicates active exploitation; the risk is elevated on multi-author sites, membership sites, or any installation that allows untrusted users to register or post gallery content.
Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allows authenticated contributors to inject persistent malicious scripts via the 'delay' shortcode attribute. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit has been identified at time of analysis, and a code-level fix has been committed to the WordPress.org plugin repository (changeset 3490676).
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged authenticated attackers to exploit incorrectly configured access control, resulting in unauthorized read access to restricted data. All plugin versions through 3.6.11 are affected per NVD and Patchstack. No public exploit identified at time of analysis, and the limited confidentiality impact (C:L) and authentication requirement (PR:L) constrain real-world blast radius, though the vulnerability remains a valid risk for multi-tenant or shared-access WordPress deployments.
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administrators to modify image gallery settings through improper access control checks on user-supplied parameters, enabling limited integrity compromise of gallery configurations. The vulnerability has an extremely low EPSS score (0.02%, 4th percentile) and requires high-privilege credentials (PR:H), significantly limiting real-world exploitability despite network accessibility.
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) lets an authenticated user with contributor-level access or higher inject JavaScript via unescaped gallery lightbox configuration values, which is then printed into an inline script on every page that embeds the affected gallery. The payload is stored and inert until a victim - most critically an administrator - loads such a page, so successful abuse requires victim user interaction and yields code execution in that victim's browser, enabling session/token theft or privileged actions performed as the victim. Publicly available exploit code exists (per WPScan's disclosure), though the EPSS score is low at roughly 0.20 percent (9th percentile) and there is no confirmed active exploitation; risk is moderate and gated on sites granting contributor+ accounts to untrusted users.
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite, WP Chill) through version 3.6.13 lets an authenticated low-privileged user - a contributor, author, or equivalent role permitted to submit gallery content - inject script that is stored server-side and later rendered in the browser of any victim who views the affected gallery page, including administrators. Because the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5, Medium), successful exploitation requires a valid low-privileged account plus a second human interaction step (the victim loading the tainted page), and impact is confined to the victim's browser session rather than the underlying server. No public exploit code has been identified at time of analysis, and no CISA KEV entry indicates active exploitation; the risk is elevated on multi-author sites, membership sites, or any installation that allows untrusted users to register or post gallery content.
Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allows authenticated contributors to inject persistent malicious scripts via the 'delay' shortcode attribute. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit has been identified at time of analysis, and a code-level fix has been committed to the WordPress.org plugin repository (changeset 3490676).
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged authenticated attackers to exploit incorrectly configured access control, resulting in unauthorized read access to restricted data. All plugin versions through 3.6.11 are affected per NVD and Patchstack. No public exploit identified at time of analysis, and the limited confidentiality impact (C:L) and authentication requirement (PR:L) constrain real-world blast radius, though the vulnerability remains a valid risk for multi-tenant or shared-access WordPress deployments.
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administrators to modify image gallery settings through improper access control checks on user-supplied parameters, enabling limited integrity compromise of gallery configurations. The vulnerability has an extremely low EPSS score (0.02%, 4th percentile) and requires high-privilege credentials (PR:H), significantly limiting real-world exploitability despite network accessibility.
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.