Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration 'script' Field
- ID
- WPSEC-2026-0167
- Plugin
- Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite)
- Affected
- all versions before 3.6.14
- Remediation
- Update to 3.6.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Image Photo Gallery Final Tiles Grid on WPSec AttackSurface
- Fix released
- Published
Description
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_gallery_configuration' AJAX action in all versions up to, and including, 3.6.13. This is due to the action storing the raw configuration JSON, including its 'script' field, without checking whether the user has the unfiltered_html capability (a check the regular gallery save form already applies), and the plugin then outputting that field as JavaScript in the gallery's onComplete callback on the front end. This makes it possible for authenticated attackers with contributor-level access and above, who can create and edit their own galleries, to inject arbitrary web scripts that execute whenever a user views a page containing the gallery.
References
- https://wpsec.com/vuln/WPSEC-2026-0167/
- https://plugins.svn.wordpress.org/final-tiles-grid-gallery-lite/tags/3.6.14/
- https://wordpress.org/plugins/final-tiles-grid-gallery-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS