Harshit

**Name of the Vulnerable Software and Affected Versions** Image Photo Gallery Final Tiles Grid WordPress plugin versions prior to 3.5.3 **Description** The issue allows users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard. This is due to the plugin not sanitising and escaping the Description field when editing a gallery. **Recommendations** For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue.