Vulnerabilities / Modula Image Gallery / WPSEC-2026-2717
Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Image Link
Medium 5.4
CWE-79Fixed in 3.0.18
- ID
- WPSEC-2026-2717
- Plugin
- Modula Image Gallery – Photo Grid & Video Gallery (modula-best-grid-gallery)
- Affected
- from 3.0.0 before 3.0.18
- Remediation
- Update to 3.0.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-07
- Attack surface
- Modula Image Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery image link (Custom URL) of Beta galleries in versions 3.0.0 up to, and including, 3.0.17, due to insufficient validation of the URL scheme when items are saved through the save-merged-items REST endpoint, and insufficient escaping when the link is output as the tile's href or followed by the lightbox. This makes it possible for authenticated attackers, with Author-level access and above, to store javascript: URLs in gallery image links that execute arbitrary script when a user clicks the image.
References
- https://wpsec.com/vuln/WPSEC-2026-2717/
- https://plugins.svn.wordpress.org/modula-best-grid-gallery/tags/3.0.18/
- https://wordpress.org/plugins/modula-best-grid-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS