CVE-2026-107178

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Image Photo Gallery Final Tiles Grid WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107178

EUVD

EUVD-2026-100889

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Image	Photo Gallery Final Tiles Grid 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Image Photo Gallery Final Tiles Grid affecting versions before 3.6.16. The plugin does not escape gallery lightbox configuration values before printing them into an inline script on pages with the gallery. This allows users with contributor-level access or higher to inject malicious JavaScript that executes in the browsers of anyone viewing the gallery, including administrators.

Detection Guidance

Check the installed version of the Image Photo Gallery Final Tiles Grid plugin in your WordPress admin panel. If it is below 3.6.16, the vulnerability is present. You can also inspect the plugin files for unsanitized user input in lightbox configuration values.

Impact Analysis

An attacker with contributor-level access or higher could inject malicious scripts that run when administrators or other users view the gallery. This could lead to unauthorized actions, data theft, or session hijacking. Administrators viewing the gallery could have their accounts compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance breaches if user data is compromised through this exploit.

Mitigation Strategies

Update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.16 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Hi! I’m here to help you understand CVE-2026-107178. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70