CVE-2026-104409: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WP Chill Image Photo Gallery Final Tiles Grid

The vulnerability identified as CVE-2026-104409 exists in the WP Chill Image Photo Gallery Final Tiles Grid WordPress plugin. It is caused by improper neutralization of input during web page generation, leading to a stored cross-site scripting (XSS) condition. This allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected site. The issue affects all versions prior to 3.6.14.

Successful exploitation could lead to limited confidentiality, integrity, and availability impacts, such as execution of arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions within the scope of the affected site. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed, with low impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, cautious handling of user input and limiting plugin usage or privileges may reduce risk.