CVE-2026-107178 Image Photo Gallery Final Tiles Grid CVE debrief

Who should care

Defenders responsible for WordPress installations with the Image Photo Gallery Final Tiles Grid plugin, particularly those with users having contributor-level access and above, should assess exposure and prioritize updating the plugin.

Why it matters

The CVE-2026-107178 vulnerability in the Image Photo Gallery Final Tiles Grid plugin allows users with contributor-level access and above to store malicious JavaScript, impacting administrators and users who view the gallery. Defenders should prioritize verification, updating, and monitoring.

• Stored XSS vulnerability allows users with contributor-level access and above to execute JavaScript in the browser of anyone who views the gallery
• Administrators who view the gallery are potentially impacted
• Verification of plugin version and user access levels is necessary
• Remediation priority is high due to potential for JavaScript execution

Technical summary

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators. This vulnerability allows for stored XSS attacks, impacting administrators and users who view the gallery. Defenders should prioritize verifying and updating the plugin to version 3.6.16 or later.

Defensive priority

Defenders should prioritize verifying and updating the Image Photo Gallery Final Tiles Grid plugin to version 3.6.16 or later, and assess exposure for users with contributor-level access and above.

Recommended defensive actions

• Verify and update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.16 or later
• Assess exposure for users with contributor-level access and above
• Monitor for suspicious activity on pages that embed the gallery
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. Defenders should verify plugin version, assess exposure for users with contributor-level access and above, and monitor for suspicious activity. Limited evidence suggests potential for JavaScript execution in administrators' browsers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.