Extension WordPress
Vulnérabilités Image Photo Gallery Final Tiles Grid
Cette page rassemble les failles publiées pour Image Photo Gallery Final Tiles Grid, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Image Photo Gallery Final Tiles Grid
12 fiches
Image Photo Gallery Final Tiles Grid <= 3.6.11 – Missing Authorization
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.6.11. This makes it possible for authenticated attackers,…
*-3.6.11
3.6.12
20/05/2026
Image Photo Gallery Final Tiles Grid <= 3.6.10 – Missing Authorization
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.6.10. This makes it possible for authenticated attackers,…
*-3.6.10
3.6.11
18/02/2026
Image Photo Gallery Final Tiles Grid <= 3.6.11 – Authenticated (Author+) Insecure Direct Object Reference
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.11 due to missing validation on a user controlled key. This makes it possible…
*-3.6.11
3.6.12
11/02/2026
Image Photo Gallery Final Tiles Grid <= 3.6.9 – Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes…
*-3.6.9
3.6.10
19/01/2026
Image Photo Gallery Final Tiles Grid <= 3.6.8 – Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This…
*-3.6.8
3.6.9
20/12/2025
Image Photo Gallery Final Tiles Grid <= 3.6.7 – Missing Authorization to Authenticated (Contributor+) Gallery Management
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to…
*-3.6.7
3.6.8
18/12/2025
Image Photo Gallery Final Tiles Grid <= 3.6.0 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on…
*-3.6.0
3.6.1
26/02/2025
Image Photo Gallery Final Tiles Grid <= 2.5.8 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Additional CSS class on A tag" field in all versions up to, and including, 2.5.8 due to insufficient input sanitization…
*-2.5.8
3.6.0
22/06/2024
Freemius SDK <= 2.4.2 – Missing Authorization Checks
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions…
[*, 3.5.5)
3.5.5
04/03/2022
Image Photo Gallery Final Tiles Grid <= 3.5.2 – Contributor+ Stored Cross-Site Scripting
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against…
*-3.5.2
3.5.3
18/01/2022
Final Tiles Gallery <= 3.4.18 – Authenticated Stored Cross-Site Scripting
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.
*-3.4.18
3.4.19
28/05/2020
Freemius SDK <= 2.2.3 – Missing Authorization to Arbitrary Options Update
The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level…
[*, 3.3.57)
3.3.57
25/02/2019
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.