This flaw arises from unsanitized user input being rendered in the plugin’s output, allowing attackers to inject and store malicious scripts that run in visitors’ browsers. Once an attacker delivers a payload—such as through a gallery item description or form field—the script executes each time the corresponding page is loaded, potentially stealing session cookies, defacing the site, or redirecting users to phishing pages. The weakness is a classic Stored Cross‑Site Scripting vulnerability (CWE‑79).

The vulnerability impacts every instance of the WordPress Image Photo Gallery Final Tiles Grid plugin up to, and including, version 3.6.13. All sites running any of those versions are candidates for exploitation until the plugin is upgraded to 3.6.14 or later.

The CVSS score of 6.5 indicates a medium severity level, and no EPSS score is available, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely used or actively exploited flaw. Because the flaw allows stored payloads that can be triggered by page visits, the attack vector is likely to be an authenticated content editor submitting gallery data, though it can be amplified through social engineering or automated content injection. Without a known exploitation chain beyond the plugin’s normal operation, the risk remains moderate but still non‑negligible for exposed websites.