Unknown Image Photo Gallery Final Tiles Grid vulnerabilities

6 vulnerabilities

Known vulnerabilities in Unknown Image Photo Gallery Final Tiles Grid, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.8CVE-2026-107178unknownimage photo gallery final tiles grid
EPSS score
0.40%
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.6.8CVE-2026-104644unknownimage photo gallery final tiles grid
EPSS score
0.32%
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.5.4CVE-2022-0186machothemesimage_photo_gallery_final_tiles_grid+2
EPSS score
0.60%
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard6.8CVE-2024-3710unknownimage photo gallery final tiles grid+2
EPSS score
0.47%
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin4.3CVE-2026-104645unknownimage photo gallery final tiles grid+1
EPSS score
0.21%
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.6.8CVE-2026-104646unknownimage photo gallery final tiles grid+1
EPSS score
0.29%
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.