Security Alert Summary
The Image Photo Gallery Final Tiles Grid plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the delay shortcode attribute in all versions up to and including 3.6.12. Authenticated users with Contributor-level access or higher can inject scripts that will execute when a user loads an affected page, due to insufficient input sanitization and output escaping.
CVE Details
- CVE ID: CVE-2026-4559
- Affected component: Image Photo Gallery Final Tiles Grid plugin for WordPress
- Affected versions: All versions up to and including 3.6.12
- Published: August 22, 2026 2:16:32 PM UTC
- Last modified: August 22, 2026 2:16:32 PM UTC
- CVSS v3.1: Base score 6.4, Medium — Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction: Authenticated attacker with Contributor-level access or higher; Privileges Required: Low; User Interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting issue that arises from insufficient input sanitization and output escaping of the delay shortcode attribute. Because the attribute value is not properly handled before storage or rendering, an authenticated user with sufficient privileges can insert arbitrary web script into a gallery shortcode. The injected script will execute in the context of any user viewing the page containing the injected shortcode.
The CVE description and provided references indicate the problem is located in the plugin code that handles the gallery shortcode output. No specific functions or REST endpoints are named in the description; the root cause is inadequate sanitization and escaping for user-supplied shortcode attribute data.
How This Could Impact Your Website
Imagine a site where multiple people can contribute content: a site owner, internal staff who publish galleries, and external contributors. A malicious or compromised contributor could supply a crafted delay value in a gallery shortcode. When other users view the page, the injected script could run and perform actions depending on what it can access in the visitor’s browser. Practical consequences include exposure of internal user email addresses or other low-sensitivity data visible to the page context, and an increased risk of targeted phishing or social engineering against staff or editors that are visible on affected pages.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor-level access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to content changes or shortcode usage.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/final-tiles-grid-gallery-lite/trunk/lib/gallery-class.php#L235
- https://plugins.trac.wordpress.org/browser/final-tiles-grid-gallery-lite/trunk/lib/gallery-class.php#L34
- https://plugins.trac.wordpress.org/changeset/3490676/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/afcb5fc3-8e53-4a0e-b4b3-26786d2f67d3?source=cve
