CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin, versions prior to 3.6.14 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization of gallery configuration values that can be overridden via the plugin's gallery shortcode . These values...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin, in versions prior to 3.6.14 , contains an authorization bypass vulnerability. The root cause is the failure to properly verify ownership on several gallery and image management actions, either by checking ownership against the wrong objec...

EUVD-2026-94763

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104645 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

EUVD-2026-94764

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update vulnerability

Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update vulnerability discovered by Ala Bouali in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.14...

PT-2026-107831

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

PT-2026-107830

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104409

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

CVE-2026-104409 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

EUVD-2026-92284

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

CVE-2026-104409 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

CVE-2026-104409

The WP Chill Image Photo Gallery Final Tiles Grid plugin (specifically the final-tiles-grid-gallery-lite component) is vulnerable to Stored Cross-Site Scripting (XSS) in versions 3.6.13 and below . The root cause is the improper neutralization of input during web page generation . Exploitation de...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.13...

PT-2026-104742

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.14 Description Improper neutralization of input during web page generation leads to Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the...

CVE-2026-104409: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

CVE-2026-4559: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...