Cross-Site Scripting in Image Photo Gallery Final Tiles Grid Plugin by WordPress
CVE-2026-107178

Currently unrated

Key Information:

Vendor

WordPress
Status
Image Photo Gallery Final Tiles Grid
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-107178?

The Image Photo Gallery Final Tiles Grid Plugin for WordPress prior to version 3.6.16 contains a vulnerability that fails to properly escape values for gallery lightbox configurations. This oversight allows users with contributor-level permissions and above to inject malicious JavaScript code into the gallery. When any user views the affected gallery, including administrators, the injected script executes in their browser, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

Image Photo Gallery Final Tiles Grid 0 < 3.6.16

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107178 - Proof of Concept

References

https://wpscan.com/vulnerability/ecc86d5a-7a2f-479e-b5f9-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ala Bouali
WPScan
.