CVE-2026-107178 Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-107178

The Image Photo Gallery Final Tiles Grid WordPress plugin, versions prior to 3.6.16 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape gallery lightbox configuration values before they are printed into an inline script on pages embedding the gallery. Th...