WP Security CheckVulnerability data as of October 22, 2026

Known vulnerabilities in Image Photo Gallery Final Tiles Grid

Image Gallery + Photo Gallery + Portfolio Gallery + Tiled Gallery in 1 plugin. Includes lightbox and hover effects. It supports Pinterest (masonry) ph …

16Reported vulnerabilities
6.8Highest CVSS score
3.6.13Latest version
20,000+Active installs

What to do now

Update Image Photo Gallery Final Tiles Grid to 3.6.15 or later. 16 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2024-3710 Medium 6.8 0.5% Before 3.6.0 3.6.0 July 13, 2024
CVE-2020-14962 Medium 5.4 0.9% Before 3.4.19 3.4.19 June 22, 2020
CVE-2022-0186 Medium 5.4 0.6% Before 3.5.3 3.5.3 February 21, 2022
CVE-2026-104644 Medium 6.4 0.3% Before 3.6.15 3.6.15 October 14, 2026
CVE-2026-107178 Medium 6.4 0.4% Before 3.6.16 3.6.16 October 14, 2026
CVE-2026-104646 Medium 6.4 0.3% 3.6.13 and earlier 3.6.14 October 6, 2026
CVE-2026-4559 Medium 6.4 0.3% 0 to 3.6.12 (inclusive) 3.6.13 August 22, 2026
CVE-2026-104409 Medium 6.4 0.2% 3.6.13 and earlier 3.6.14 October 5, 2026
CVE-2025-13693 Medium 6.4 0.2% 0 to 3.6.8 (inclusive) 3.6.9 December 21, 2025
CVE-2025-14455 Medium 5.4 0.3% 0 to 3.6.7 (inclusive) 3.6.8 December 19, 2025
CVE-2024-6261 Medium 5.4 0.3% Before 3.6.1 3.6.1 February 27, 2025
CVE-2025-15466 Medium 5.4 0.2% 3.6.9 and earlier 3.6.10 January 19, 2026
CVE-2026-104645 Medium 4.3 0.2% Before 3.6.14 3.6.14 October 8, 2026
CVE-2026-27424 Medium 4.3 0.3% 3.6.11 and earlier 3.6.12 May 20, 2026
CVE-2026-25375 Medium 4.3 0.3% 3.6.10 and earlier 3.6.11 February 18, 2026
CVE-2026-39510 Medium 4.3 0.3% 3.6.11 and earlier 3.6.12 February 11, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.