instantCVE
← all CVEs

CVE-2026-121976

Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

Published 7 Nov 2026 • Updated 7 Nov 2026

Severity: MEDIUM

6.4

CVSS Base Score

Description

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save_merged_items() REST handler and Images\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile.

Affected products (1)

  • wpchill Modula Image Gallery – Photo Grid & Video Gallery

Problem types

  • CWE-79 Improper Neutralization of Input During Web Page Generation

References (8)

Get alerted the moment a CVE like this matches your stack.

Create a free account