The WordPress plugin Image Photo Gallery Final Tiles Grid contains a stored cross‑site scripting flaw that arises from unescaped lightbox configuration values being inserted into an inline script on every gallery page. Because users with contributor level or higher privileges can edit galleries, an attacker can inject arbitrary JavaScript via the lightboxOptions parameter. When any visitor, including site administrators, loads a page that embeds the gallery, the malicious script runs in the visitor’s browser. The payload can steal session cookies, deface the site, or perform further client‑side attacks. The weakness corresponds to stored XSS, a classic flaw that allows execution of attacker‑supplied code inside a trusted domain.

All installations of the Image Photo Gallery Final Tiles Grid WordPress plugin earlier than version 3.6.16 are potentially vulnerable. The vulnerability exists regardless of server configuration or other plugins, as it is a rendering issue within the plugin itself. Sites hosting the plugin, whether on shared hosting or dedicated servers, are at risk if they have not deployed the patch included in version 3.6.16.

The EPSS score for this vulnerability is listed as less than 1 %, indicating a low overall exploitation probability. The CVSS score is 6.8, indicating moderate severity. It is not currently recorded in the CISA KEV catalog. Exploitation requires an attacker to possess at least contributor‑level access to the WordPress site, which typically limits the attack surface to sites whose accounts are compromised or misconfigured. Once an attacker injects the payload, it will execute automatically in the browsers of any user who views the affected gallery, providing a wide range of downstream effects such as credential theft or defacement. The internal nature of the attack vector means that it is primarily limited to privileged users, but if additional trusted users simulate visitors, the risk expands to include administrators as well.