CVE-2026-104646

MediumCVSS 6.8/10Last modified Oct 8, 2026

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1046514.3The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the targ CVE-2026-1046526.8The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image t CVE-2026-1046536.8The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before sto CVE-2026-1046587.8The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file writ CVE-2026-1046597.5Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailSe CVE-2026-1046607.8Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with CVE-2026-1046614.3GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that,CVE-2026-1046676.8The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatena CVE-2026-1046707.1Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.CVE-2026-1046715.3The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers CVE-2026-1046727.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-1046736.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Rad