CVE-2026-4559: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpchill Image Photo Gallery Final Tiles Grid

CVE-2026-4559 describes a stored cross-site scripting vulnerability in the Image Photo Gallery Final Tiles Grid plugin for WordPress. The flaw exists in all versions up to and including 3.6.12 and is triggered through the 'delay' shortcode attribute. Authenticated attackers with Contributor-level privileges or above can inject arbitrary web scripts into pages, which execute upon page access due to improper neutralization of input during web page generation (CWE-79). The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher access can inject malicious scripts that execute in the context of users visiting the compromised pages. This can lead to information disclosure and integrity impacts, but no availability impact is noted. The vulnerability allows cross-site scripting attacks that can affect site visitors and administrators.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users and consider disabling or removing the vulnerable plugin to prevent exploitation.