CVE-2026-4559: WordPress Image Photo Gallery XSS Vulnerability

CVE-2026-4559 Overview

CVE-2026-4559 is a Stored Cross-Site Scripting (XSS) vulnerability in the Image Photo Gallery Final Tiles Grid plugin for WordPress. The flaw affects all versions up to and including 3.6.12. The plugin fails to sanitize and escape the delay shortcode attribute, allowing authenticated users with Contributor-level access or higher to inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any user who visits an affected page, enabling session theft, redirection, and further compromise in the context of the victim's origin.

Critical Impact
Authenticated Contributor accounts can persistently store JavaScript that executes for every visitor, including administrators, enabling session hijacking and privileged action abuse.

Affected Products

Image Photo Gallery Final Tiles Grid plugin for WordPress (all versions ≤ 3.6.12)
WordPress sites permitting Contributor or higher registration with the plugin installed
Downstream sites embedding the Final Tiles Grid Gallery Lite shortcode

Discovery Timeline

2026-08-22 - CVE-2026-4559 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-4559

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw [CWE-79] in the Final Tiles Grid Gallery Lite plugin. The plugin exposes a shortcode used to render image galleries within WordPress posts and pages. The delay attribute of that shortcode is rendered into gallery markup without sufficient input sanitization or output escaping.

An authenticated attacker with Contributor privileges can insert the shortcode into a post and supply attacker-controlled JavaScript through the delay attribute. The payload persists in the database as post content. When any user renders the page, the browser executes the injected script under the site's origin.

Because the injected script runs with the privileges of the viewing user, the impact scales with the audience. If an administrator previews or publishes the attacker's draft, the payload can create new admin users, plant backdoors in themes or plugins, or exfiltrate authentication cookies. See the Wordfence Vulnerability Overview for additional analysis.

Root Cause

The root cause is missing input sanitization and missing output escaping around the delay shortcode attribute in lib/gallery-class.php. The value is concatenated into HTML output without functions such as esc_attr() or wp_kses(). Relevant code paths are documented at gallery-class.php L34 and gallery-class.php L235.

Attack Vector

Exploitation requires an authenticated account at Contributor level or above. The attacker inserts the plugin's gallery shortcode into a post draft and sets a crafted delay attribute containing JavaScript, for example breaking out of the surrounding attribute context with quotes and event handlers. The payload is stored in the post record. When a reviewer, editor, administrator, or public visitor loads the rendered page, the browser parses and executes the injected script within the site's origin. No user interaction beyond navigating to the page is required.

No verified public exploit code is available at the time of writing. The vulnerability mechanism is documented in WordPress Changeset #3490676, which contains the vendor fix.

Detection Methods for CVE-2026-4559

Indicators of Compromise

Posts or pages containing Final Tiles Grid shortcodes where the delay attribute includes characters such as ", <, >, onerror, onload, or javascript:
Unexpected <script> tags or event-handler attributes rendered inside gallery containers on published pages
New WordPress administrator accounts, modified user roles, or altered plugin/theme files following Contributor activity
Outbound requests from site visitors' browsers to unfamiliar domains referenced by gallery pages

Detection Strategies

Query the wp_posts table for post_content matching the plugin's shortcode with suspicious characters in the delay parameter
Review the audit trail for Contributor-level users who created or edited posts containing gallery shortcodes
Compare currently installed plugin version against 3.6.12; any equal or lower version is vulnerable
Inspect rendered HTML of pages using the shortcode for script contexts inside gallery attributes

Monitoring Recommendations

Enable WordPress audit logging for post creation, revisions, and role changes by non-Editor accounts
Deploy a Content Security Policy that restricts inline scripts and unauthorized script sources
Alert on modifications to wp-config.php, theme functions, and plugin files after Contributor post submissions
Forward web server and WordPress logs to a centralized data lake for retention and correlation across sessions

How to Mitigate CVE-2026-4559

Immediate Actions Required

Update the Image Photo Gallery Final Tiles Grid plugin to the version released in WordPress Changeset #3490676, which supersedes 3.6.12
Audit all existing posts and pages for the plugin's shortcode and inspect the delay attribute for injected script content
Rotate WordPress administrator credentials and invalidate active sessions if Contributor activity on gallery-bearing pages is observed
Restrict Contributor registration and require review of all Contributor drafts before rendering in a privileged browser session

Patch Information

The vendor addressed the flaw in the plugin release documented by WordPress Changeset #3490676. The fix applies proper sanitization and escaping to the delay shortcode attribute. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin directory with the patched release.

Workarounds

Deactivate the Final Tiles Grid Gallery Lite plugin until the patched version is deployed
Remove the Contributor role from untrusted users or downgrade them to Subscriber
Configure a Web Application Firewall rule to block requests containing delay= values with HTML metacharacters targeting the plugin's shortcode
Enforce a strict Content Security Policy that disallows inline JavaScript on pages rendering plugin shortcodes

bash

# Example: locate vulnerable plugin installs and posts referencing the shortcode
wp plugin get final-tiles-grid-gallery-lite --field=version
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[FinalTilesGallery%delay=%'"