All vulnerabilities
CVE-2026-104644

Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update

Unknown Image Photo Gallery Final Tiles Grid
Open in ThreatlineRecord JSON
CVSS
6.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.6.15Fixed versionCVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 3.6.15Image Photo Gallery Final Tiles GridCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

Text from CVE List

Affected versions 1

  • Image Photo Gallery Final Tiles Gridaffected: all versions before 3.6.15CVE List

References 1