CVE-2026-104646 in Image Photo Gallery Final Tiles Grid Plugin
Summary
by MITRE • 10/08/2026
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Image Photo Gallery Final Tiles Grid WordPress plugin versions prior to 3.6.14 represents a critical server-side request forgery and cross-site scripting flaw rooted in insufficient input validation within the shortcode processing mechanism. The core technical deficiency lies in the failure of the plugin to properly sanitize several gallery configuration values before they are embedded into an inline JavaScript block on the frontend page. This architectural oversight allows attackers who possess contributor-level access or higher privileges to manipulate these parameters, effectively bypassing standard WordPress security boundaries that typically restrict such actions to administrators. The flaw is particularly severe because it does not require any specific ownership of the gallery; instead, an attacker can reference any existing gallery configuration on the site to trigger the injection, thereby broadening the attack surface significantly beyond just galleries created by the malicious user.
From a technical perspective, this vulnerability facilitates stored cross-site scripting where arbitrary JavaScript code is injected into the page context through malformed shortcode attributes. When a visitor loads a post containing the manipulated shortcode, the unsanitized values are rendered directly into an inline script block without escaping or validation. This results in the immediate execution of attacker-controlled scripts within the browser session of every user viewing that specific content. The impact extends beyond simple defacement or cookie theft; because the injection occurs during page load for all viewers, it enables persistent compromise of the site's frontend integrity. An administrator previewing a pending submission from an untrusted contributor is also vulnerable to this attack vector, as the preview function renders the same inline scripts in the admin interface, potentially leading to administrative account takeover or further exploitation within the WordPress dashboard environment.
The operational impact of this vulnerability is substantial, affecting both site availability and data confidentiality depending on the payload delivered by the attacker. By executing arbitrary JavaScript, an adversary can perform actions such as stealing session cookies, performing authenticated requests on behalf of users, redirecting traffic to malicious sites for phishing purposes, or defacing the visual presentation of the website. The ability to target administrators during preview operations is particularly dangerous as it allows attackers to escalate privileges from a low-level contributor account to full administrative control without needing direct login credentials. This undermines the principle of least privilege in WordPress role management and exposes sensitive backend functionality to exploitation through frontend vectors that are often less monitored than direct API endpoints or admin pages.
Mitigation strategies for this vulnerability primarily involve immediate software updates and rigorous input validation practices. Site administrators should upgrade the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later, where these sanitization issues have been addressed by the developers. In environments where updating is not immediately feasible, temporary mitigations may include restricting contributor-level access to trusted individuals only, as this role possesses the necessary permissions to exploit the flaw. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking malicious JavaScript injection patterns in shortcode parameters can provide an additional layer of defense. Long-term remediation requires adopting secure coding standards that mandate strict output encoding for all dynamic content inserted into script contexts, ensuring that special characters are properly escaped before rendering to prevent code execution.
This vulnerability aligns with Common Weakness Enumeration category CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector leverages the trust relationship between a web browser and the website served by WordPress, exploiting the ability of authenticated users to inject malicious scripts into trusted pages. In terms of MITRE ATT&CK framework classification, this behavior corresponds to techniques involving Client-side Injection such as XSS (T1059) and potentially Account Manipulation if used for privilege escalation via admin session hijacking. The lack of gallery ownership requirements further emphasizes the severity, as it removes a common access control barrier that might otherwise limit exploitation to only those who create new content, allowing any authenticated user with minimal privileges to impact all site visitors regardless of their interaction history with specific galleries.