Final Tiles Grid Gallery Lite Vulnerabilities

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVSS:

6.4

Affected:

up to 3.6.12

Fixed in:

3.6.13

Disclosed:

Aug 22, 2026

CVE-2026-4559 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.6.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.6.11

Fixed in:

3.6.12

Disclosed:

May 20, 2026

CVE-2026-27424 on NVD →

[en] Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.

Affected:

up to 3.6.10

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-25375 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.6.10. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.6.10

Fixed in:

3.6.11

Disclosed:

Feb 18, 2026

CVE-2026-25375 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to perform an unauthori...

CVSS:

4.3

Affected:

up to 3.6.11

Fixed in:

3.6.12

Disclosed:

Feb 11, 2026

CVE-2026-39510 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above,...

CVSS:

5.4

Affected:

up to 3.6.9

Fixed in:

3.6.10

Disclosed:

Jan 19, 2026

CVE-2025-15466 on NVD →

[en] The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and ab...

Affected:

up to 3.6.10

Fixed in:

3.6.10

Disclosed:

Jan 19, 2026

CVE-2025-15466 on NVD →

[en] The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level a...

Affected:

up to 3.6.9

Fixed in:

3.6.9

Disclosed:

Dec 21, 2025

CVE-2025-13693 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVSS:

6.4

Affected:

up to 3.6.8

Fixed in:

3.6.9

Disclosed:

Dec 20, 2025

CVE-2025-13693 on NVD →

[en] The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated at...

Affected:

up to 3.6.8

Fixed in:

3.6.8

Disclosed:

Dec 19, 2025

CVE-2025-14455 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attacke...

CVSS:

5.4

Affected:

up to 3.6.7

Fixed in:

3.6.8

Disclosed:

Dec 18, 2025

CVE-2025-14455 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...

CVSS:

6.4

Affected:

up to 3.6.0

Fixed in:

3.6.1

Disclosed:

Feb 26, 2025

CVE-2024-6261 on NVD →

[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....

Affected:

up to 3.5.5

Fixed in:

3.5.5

Disclosed:

Oct 16, 2024

CVE-2022-4974 on NVD →

[en] The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high pri...

Affected:

up to 3.6.0

Fixed in:

3.6.0

Disclosed:

Jul 13, 2024

CVE-2024-3710 on NVD →

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Additional CSS class on A tag" field in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contri...

CVSS:

6.4

Affected:

up to 2.5.8

Fixed in:

3.6.0

Disclosed:

Jun 22, 2024

CVE-2024-3710 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 3.5.5

Fixed in:

3.5.5

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

Affected:

up to 3.5.5

Fixed in:

3.5.5

Disclosed:

Mar 4, 2022

Sensitive Information Disclosure vulnerability discovered in WordPress Image Photo Gallery Final Tiles Grid plugin (versions <= 3.5.4).

Affected:

up to 3.5.5

Fixed in:

3.5.5

Disclosed:

Feb 28, 2022

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Image Photo Gallery Final Tiles Grid plugin (versions <= 3.5.4).

Affected:

up to 3.5.5

Fixed in:

3.5.5

Disclosed:

Feb 28, 2022

[en] The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard

Affected:

up to 3.5.5

Fixed in:

3.5.5

Disclosed:

Feb 21, 2022

CVE-2022-0186 on NVD →

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard

CVSS:

5.4

Affected:

up to 3.5.2

Fixed in:

3.5.3

Disclosed:

Jan 18, 2022

CVE-2022-0186 on NVD →

[en] Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.

Affected:

up to 3.4.19

Fixed in:

3.4.19

Disclosed:

Jun 21, 2020

CVE-2020-14962 on NVD →

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.

CVSS:

6.4

Affected:

up to 3.4.18

Fixed in:

3.4.19

Disclosed:

May 28, 2020

CVE-2020-14962 on NVD →

Authenticated Option Update vulnerability (Fremius Library security issue) found in WordPress Image Photo Gallery Final Tiles Grid plugin (versions <= 3.3.52).

Affected:

up to 3.3.57

Fixed in:

3.3.57

Disclosed:

Mar 2, 2019

The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and...

CVSS:

8.8

Affected:

up to 3.3.57

Fixed in:

3.3.57

Disclosed:

Feb 25, 2019

The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and...

Affected:

up to 3.3.57

Fixed in:

3.3.57

Disclosed:

Feb 25, 2019

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.5.8

Fixed in:

3.5.8

CVE-2023-33999 on NVD →

The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options

Affected:

up to 3.3.57

Fixed in:

3.3.57

Affected:

up to 3.6.1

Fixed in:

3.6.1

CVE-2024-6261 on NVD →