The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline scrip…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · NIST NVD

   Detected

   The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

2. Oct 14, 2026 · NIST NVD

   Updated

   The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

Sources

• CVE.orgVulnerability recordCVE-2026-107178

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-107178

  30-day exploitation probability 0.4%

  first.org
• NIST NVDVulnerability recordCVE-2026-107178

  The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScri

  nvd.nist.gov

References

• Reference · wpscan.com