CVE-2026-4559 describes a stored cross-site scripting vulnerability in the Image Photo Gallery Final Tiles Grid plugin for WordPress. The flaw exists in the handling of the 'delay' shortcode attribute, which lacks proper input sanitization and output escaping. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all plugin versions up to and including 3.6.12. No official patch or remediation level has been published at this time.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who view the compromised pages, potentially leading to information disclosure or session compromise. The vulnerability does not require user interaction beyond page access and does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.