The Image Photo Gallery Final Tiles Grid WordPress plugin version 3.6.15 and earlier fails to sanitize or escape configuration values before echoing them into an inline script on every page that embeds the gallery. This allows any user with contributor-level access or higher to store malicious JavaScript within the gallery configuration, which then executes in the browser of anyone who views the gallery, including administrators. The vulnerability permits the attacker to run arbitrary JavaScript code in the victim’s browser context at the time the gallery page is rendered.

The vulnerability affects installations of the Image Photo Gallery Final Tiles Grid WordPress plugin with a version earlier than 3.6.15. No additional vendors or products are listed, and the affected‑version range is limited to pre‑3.6.15 releases of this plugin.

This weakness is classified as a stored cross‑site scripting flaw (CWE‑79). The CVSS score of 6.8 indicates moderate severity, and the EPSS score indicates a low probability of exploitation (<1 %), and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is through gallery configuration updates performed by a user with contributor-level access or higher, who can embed arbitrary script. Successful exploitation would cause arbitrary script execution in the browsers of all users who view the gallery.