CVE-2026-104646

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.14

Description Insufficient sanitization of gallery configuration values that can be overridden via the gallery shortcode allows users with contributor-level access and above to perform a Stored Cross-Site Scripting (XSS) attack. This occurs when the values are printed into an inline script block, enabling the injection of arbitrary JavaScript. The script executes in the session of any user viewing the post, including administrators previewing pending submissions. This issue does not require gallery ownership, as any existing gallery on the site can be referenced.

Recommendations Update Image Photo Gallery Final Tiles Grid to version 3.6.14 or later.