Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- ID
- WPSEC-2026-0165
- Plugin
- Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite)
- Affected
- from 3.3.10 before 3.6.14
- Remediation
- Update to 3.6.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Image Photo Gallery Final Tiles Grid on WPSec AttackSurface
- Fix released
- Published
Description
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'FinalTilesGallery' shortcode attributes (such as 'script' and 'margin') in versions 3.3.10 up to, and including, 3.6.13. This is due to shortcode attributes being allowed to override any stored gallery property, including the custom 'script' field, which is output as the body of the gallery's inline onComplete JavaScript callback, and numeric options such as 'margin' being printed into inline JavaScript with only esc_attr(), which does not prevent injection in an unquoted script context. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0165/
- https://plugins.svn.wordpress.org/final-tiles-grid-gallery-lite/tags/3.6.14/
- https://wordpress.org/plugins/final-tiles-grid-gallery-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS