CVE-2026-4559

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.13

Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the delay shortcode attribute, which then execute when a user visits the affected page.

Recommendations Update Image Photo Gallery Final Tiles Grid to a version newer than 3.6.12. Avoid using the delay shortcode attribute until the update is applied.