CVE-2026-107178

MediumCVSS 6.8/10Last modified Oct 14, 2026

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-107184.6Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing CVE-2026-1071807.1On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication s CVE-2026-1071818.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inje CVE-2026-1071838.1llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated r CVE-2026-1071868.6An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run work CVE-2026-1071878.5A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authent CVE-2026-1071889.6A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the fil CVE-2026-107191.8Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writin CVE-2026-1071936.5A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the CVE-2026-1071949.2Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially CVE-2026-10724.3The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. Th CVE-2026-107205.1Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of