Medium severity5.4NVD Advisory· Published Feb 21, 2022· Updated Jun 17, 2026

CVE-2022-0186

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Machothemes/Image Photo Gallery Final Tiles Grid
cpe:2.3:a:machothemes:image_photo_gallery_final_tiles_grid:*:*:*:*:*:wordpress:*:*
Range: <3.5.3
WordPress/Final Tiles Grid Gallery Litecpe-rescue
Package: https://wordpress.org/plugins/final-tiles-grid-gallery-lite
WordPress/Image Photo Gallery Final Tiles Gridllm-fuzzy
Range: <3.5.3

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/3a9c44c0-866e-4fdf-b53d-666db2e11720nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000