Cross-Site Scripting Vulnerability in Image Photo Gallery Final Tiles Grid Plugin by WordPress
CVE-2026-104644

Currently unrated

Key Information:

Vendor

WordPress
Status
Image Photo Gallery Final Tiles Grid
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104644?

The Image Photo Gallery Final Tiles Grid Plugin for WordPress contains a vulnerability allowing users with contributor-level access and higher to inject malicious JavaScript. This occurs due to improper sanitization and escaping of gallery configuration values, which are echoed in an inline script on pages embedding the gallery. As a result, an attacker could manipulate the gallery to execute scripts in the browser of any visitor, including administrators, posing a significant security risk.

Affected Version(s)

Image Photo Gallery Final Tiles Grid 0 < 3.6.15

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104644 - Proof of Concept

References

https://wpscan.com/vulnerability/874eeea9-59a1-4ec0-b884-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdullah Kareem
WPScan
.