CVE-2026-104644

6.8 Moyenne

Publiée le 14/10/2026 à 09:17 · Modifiée le 14/10/2026 à 18:14 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

Traduire en français

Produits concernés

Unknown Image Photo Gallery Final Tiles Grid

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/874eeea9-59a1-4ec0-b884-76d1bb6dba22/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories