Description

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-22T14:16:32.947Z",
  "pubdate": "2026-08-22T14:16:32.947Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists within the Image Photo Gallery Final Tiles Grid plugin for WordPress in all versions up to, and including, 3.6.12. The vulnerability arises from insufficient input sanitization and output escaping implemented on the 'delay' shortcode attribute.\nThis security flaw enables authenticated threat actors possessing Contributor-level access and above to inject arbitrary web scripts, such as malicious JavaScript, directly into vulnerable application pages.\nWhen an unsuspecting user or administrator accesses an injected page containing the crafted shortcode, the malicious script executes within the context of their active browser session. This can lead to unauthorized actions, session hijacking, credential theft, and further compromise of the affected WordPress site.\nThe risk implication is elevated due to the potential for privilege escalation via administrative session compromise, despite the prerequisite requirement for authenticated Contributor-level privileges.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Image Photo Gallery Final Tiles Grid plugin to properly sanitize user-supplied input passed through the 'delay' shortcode attribute and to adequately escape output before rendering it in the Document Object Model (DOM).\nThe vulnerable component is the shortcode parsing and rendering engine of the Image Photo Gallery Final Tiles Grid plugin, affecting all software versions up to, and including, 3.6.12.\nExploitation of this vulnerability requires network access to the target WordPress installation and authenticated privileges at the Contributor level or higher. A threat actor leverages their capability to author or edit posts and pages to insert the malicious payload.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker crafts a malicious shortcode payload embedding arbitrary JavaScript within the 'delay' attribute. Second, the attacker publishes or embeds this shortcode within a WordPress post, page, or other shortcode-parsing context. Third, the plugin processes the shortcode without properly sanitizing the 'delay' parameter value. Fourth, the unsanitized payload is stored persistently within the WordPress database. Fifth, when a victim or administrator navigates to the rendered page, the server outputs the payload into the HTML response without adequate escaping. Finally, the victim's browser interprets and executes the malicious script within their session context, allowing the execution of arbitrary actions on behalf of the user."
}