Stored Cross-Site Scripting in Image Photo Gallery Plugin for WordPress
CVE-2024-6261
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 February 2025
What is CVE-2024-6261?
The Image Photo Gallery Final Tiles Grid plugin for WordPress contains a security flaw that allows authenticated attackers, including users with contributor-level permissions and above, to perform stored cross-site scripting (XSS) attacks. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes within the plugin's 'FinalTilesGallery' shortcode. As a result, attackers can inject arbitrary scripts that execute whenever a vulnerable page is accessed, potentially compromising user sessions and leading to unauthorized actions.
Affected Version(s)
Image Photo Gallery Final Tiles Grid * <= 3.6.0