TI-2026-73843 Aliases CVE-2026-107178 GHSA-pgp8-c2p2-rr7f

Stored XSS in Image Photo Gallery Final Tiles Grid via lightboxOptions

LOW 32CWE-79Published 2026-10-14 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script. This lets users with contributor-level access and above store JavaScript that runs in the browser of anyone who views the gallery, including administrators. The flaw is cross-site scripting (CWE-79), and an attacker needs an authenticated contributor account while a victim must view a page that embeds the gallery. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00383 32nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Image Photo Gallery Final Tiles Grid (Unknown): 3.6.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Image Photo Gallery Final Tiles Grid	before 3.6.16	3.6.16	Patch available	CNA

Image Photo Gallery Final Tiles Grid VendorUnknown Affected before 3.6.16 Fixed in 3.6.16 Patch available CNA

Remediation

Update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.16 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Image Photo Gallery Final Tiles Grid (Unknown) Fixed in 3.6.16

Timeline

2026-10-14 Threatist record created from CVE-2026-107178
2026-10-14 Alias added: GHSA-pgp8-c2p2-rr7f
2026-10-14 CVSS score added · CISA ADP
2026-10-14 Weakness changed · CISA ADP
2026-10-14 CISA SSVC decision points changed

References

Exploit 1

https://wpscan.com/vulnerability/ecc86d5a-7a2f-479e-b5f9-cf86f14fc404/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences