CVE-2026-104646 Image Photo Gallery Final Tiles Grid CVE debrief

Who should care

Defenders responsible for WordPress site security, particularly those with contributor-level access or above, should assess exposure and prioritize updating the plugin to version 3.6.14 or later.

Why it matters

The CVE-2026-104646 vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin allows for stored XSS attacks, potentially leading to JavaScript injection and execution in user sessions. Defenders should prioritize verifying and updating the plugin to version 3.6.14 or later, and monitoring for suspicious activity.

• JavaScript injection and execution in user sessions
• Potential for administrator compromise
• Exposure of sensitive data or functionality

Technical summary

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly sanitize gallery configuration values that can be overridden through its gallery shortcode. This allows users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. The vulnerability exists due to insufficient sanitization of user-input data, which can lead to stored XSS attacks. Defenders should prioritize verifying and updating the plugin to version 3.6.14 or later, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and updating the plugin to version 3.6.14 or later, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later
• Monitor for suspicious activity and JavaScript injection attempts
• Restrict contributor-level access to sensitive areas of the WordPress site
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Image Photo Gallery Final Tiles Grid WordPress plugin before version 3.6.14. The plugin does not properly sanitize gallery configuration values that can be overridden through its gallery shortcode, allowing for stored XSS attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.