CVE-2026-104644

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Image Photo Gallery Final Tiles Grid WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104644

EUVD

EUVD-2026-100876

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Image	Photo Gallery Final Tiles Grid 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin. It occurs because the plugin does not properly sanitize or escape gallery configuration values before embedding them into an inline script on pages that display the gallery.

Detection Guidance

Check if the WordPress plugin 'Image Photo Gallery Final Tiles Grid' is installed and verify its version. If the version is below 3.6.15, the system is vulnerable. Inspect pages with galleries for unexpected inline scripts or JavaScript code in gallery configurations.

Impact Analysis

Users with contributor-level access or higher can inject malicious JavaScript code that executes in the browsers of anyone viewing the gallery, including administrators. This could lead to unauthorized actions, data theft, or session hijacking on the affected WordPress site.

Compliance Impact

This vulnerability could compromise user data privacy, potentially violating GDPR and HIPAA requirements for data protection and security. Unauthorized script execution may lead to data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update the 'Image Photo Gallery Final Tiles Grid' plugin to version 3.6.15 or later immediately. Review user roles with contributor-level access or higher for unauthorized changes. Remove any suspicious JavaScript code from gallery configurations.

Hi! I’m here to help you understand CVE-2026-104644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70