CVE-2026-107178
Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
| Vendor | unknown |
| Product | image photo gallery final tiles grid |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown image photo gallery final tiles grid
Be the first to know when new unknown vulnerabilities affecting unknown image photo gallery final tiles grid are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Image Photo Gallery Final Tiles Grid
0 < 3.6.16
References
Credits
Ala Bouali WPScan