The Image Photo Gallery Final Tiles Grid plugin’s Custom Scripts option accepts arbitrary code without proper sanitization or escaping. An authenticated user with Author or higher privileges can store malicious JavaScript that executes in the browsers of any visitor who views a page containing the injected content. This possibility can lead to cookie theft, session hijacking, defacement, or additional malicious activity performed within the victim’s session context.

WordPress sites running the wpchill Image Photo Gallery Final Tiles Grid plugin version 3.6.8 or earlier are vulnerable. The issue is confined to these plugin versions and does not affect newer releases.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalogue. Exploitation requires that the attacker is logged in as an author or higher; a legitimate author can inject code that will then execute in any user’s browser when an affected page is viewed. No additional software or network conditions appear to be required beyond normal operation of the WordPress site.