WordPress Image Photo Gallery Final Tiles Grid CVE-2026-4559 Authenticated Stored XSS

Vulnerability Overview Vulnerability Name: Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute CVE ID: CVE-2026-4559 CVSS Score: 6.4 (Medium) Publication Date: August 22, 2026 Last Updated: August 22, 2026 Researchers: Athiwat Tiprasaham (Jitada), Ithodei Aramori (Boeing777) Affected Software Software Type: Plugin Software Name: Image Photo Gallery Final Tiles Grid Affected Versions: <= 3.6.12 Fixed Version: 3.6.13 Remediation Fix Status: Yes Fixed Version: 3.6.13 Vulnerability Description The Image Photo Gallery Final Tiles Grid plugin for WordPress contains a Stored Cross-Site Scripting (Stored XSS) vulnerability. The vulnerability exists in the 'delay' shortcode attribute and affects all versions up to and including 3.6.12. Due to insufficient input sanitization and output escaping, an attacker can inject arbitrary web scripts that are executed when users visit the affected pages. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Recent Vulnerabilities Image Photo Gallery Final Tiles Grid <= 3.6.11 - Missing Authorization - CVE ID: CVE-2026-27424 - CVSS: 4.3 - Researchers: Que Thanh Tuan - Date: May 20, 2026 Image Photo Gallery Final Tiles Grid <= 3.6.10 - Missing Authorization - CVE ID: CVE-2026-25375 - CVSS: 4.3 - Researchers: Nabil Irawan - Date: February 18, 2026 Image Photo Gallery Final Tiles Grid <= 3.6.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting - CVE ID: CVE-2025-13693 - CVSS: 6.4 - Researchers: Athiwat Tiprasaham (Jitada), Ithodei Aramori (Boeing777), Pongya, Weis Bankham, Varakorn Chanthasri (CresM), Peerapat Samatthanyakorn - Date: December 20, 2025 Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management - CVE ID: CVE-2025-14455 - CVSS: 5.4 - Researchers: JongHwan Shin (zzzsleep) - Date: December 18, 2025 Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting - CVE ID: CVE-2024-6261 - CVSS: 6.4 - Researchers: Webbeaut - Date: February 26, 2025 Image Photo Gallery Final Tiles Grid <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-3710 - CVSS: 6.4 - Researchers: Dmitrii Ignatyev - Date: June 22, 2024 Freemius SDK <= 2.4.2 - Missing Authorization Checks - CVE ID: CVE-2022-4974 - CVSS: 6.3 - Researchers: Harshit, Siddhant Chouhan - Date: March 4, 2022 Image Photo Gallery Final Tiles Grid <= 3.5.2 - Contributor+ Stored Cross-Site Scripting - CVE ID: CVE-2022-0186 - CVSS: 5.4 - Researchers: Harshit, Siddhant Chouhan - Date: January 18, 2022 Additional Information Wordfence Intelligence offers free access to its personal and commercial comprehensive WordPress vulnerability database via API, supporting webhook integration for real-time vulnerability alerts. The Wordfence Intelligence WordPress vulnerability database is fully free to access and query, with vulnerability data available via API. Footer Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support Response Time: 24-hour support, year-round, with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Defiant grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copies must include this link and copyright notice. Contact Us Contact Email: wfi-support@wordfence.com Social Media Facebook: Wordfence Twitter: Wordfence LinkedIn: Wordfence Instagram: Wordfence Subscribe Subscription Box: Enter email address to subscribe to news and updates Agree to Terms: Checking the box indicates agreement to the Terms of Service and Privacy Policy Button SIGN UP: Subscribe button Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products Wordfence Free: Free Version Wordfence Premium: Premium Version Wordfence Care: Care Version Wordfence Response: Response Version Wordfence CLI: Command Line Interface Wordfence Intelligence: Intelligence Version Wordfence Central: Central Version Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Stay Updated Subscription Box: Enter email address to subscribe to news and u

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Image Photo Gallery Final Tiles Grid CVE-2026-4559 Authenticated Stored XSS

More from this source