The plugin’s 'delay' shortcode attribute lacks proper sanitization and escaping, allowing an authenticated contributor or higher to store malicious JavaScript code in a gallery. When a visitor views the affected page, the script executes in the visitor’s browser, potentially stealing session cookies, defacing the site, or redirecting users. The vulnerability is classified as a stored Cross‑Site Scripting flaw (CWE‑79) and does not provide direct remote code execution, but it enables attackers to run arbitrary scripts in the context of any site visitor.

All WordPress installations running the Image Photo Gallery Final Tiles Grid plugin version 3.6.12 or earlier are vulnerable. The affected vendor is wpchill, and the plugin is installed through the WordPress plugin repository. Contributors and users with higher privileges who can create or edit galleries using the 'delay' shortcode are required for exploitation; non‑authenticating users cannot trigger the injection through this attribute.

The CVSS base score is 6.4, indicating a medium severity. Exploitation requires authentication with Contributor-level or higher access, making the EPSS unavailable; the vulnerability is not currently listed in the CISA KEV catalog. Attackers could inject scripts that execute for any visitor to a gallery page, which could lead to session hijacking or defacement. While the attack vector is limited to authenticated users, the potential impact on site stakeholders and user trust warrants prompt patching.