CVE-2026-104646: CWE-79 Cross-Site Scripting (XSS) in Image Photo Gallery Final Tiles Grid

CVE-2026-104646 is a cross-site scripting (CWE-79) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin versions prior to 3.6.14. The vulnerability occurs because the plugin does not sanitize certain gallery configuration values that can be overridden through its shortcode. This allows users with contributor-level privileges or higher to inject malicious JavaScript into an inline script block. The injected script executes in the session context of any user viewing the post, including administrators previewing pending submissions. Exploitation does not require ownership of the referenced gallery, only that the gallery exists on the site.

Successful exploitation allows an attacker with contributor-level access or above to execute arbitrary JavaScript in the browsers of users viewing the affected post. This can lead to session hijacking, privilege escalation, or other malicious actions within the context of the vulnerable WordPress site. The vulnerability affects all users who view the compromised post, including administrators, increasing the risk of site compromise.

A fix is available in version 3.6.14 of the Image Photo Gallery Final Tiles Grid plugin. Users should upgrade to version 3.6.14 or later to remediate this vulnerability. Until then, restrict contributor-level access to trusted users and avoid referencing existing galleries in shortcodes from untrusted contributors. Patch status is confirmed by the versioning information indicating the vulnerability is fixed in 3.6.14.