{
 "id": "WPSEC-2026-2717",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2717/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2717/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2717/index.md",
 "title": "Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Image Link",
 "description": "The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery image link (Custom URL) of Beta galleries in versions 3.0.0 up to, and including, 3.0.17, due to insufficient validation of the URL scheme when items are saved through the save-merged-items REST endpoint, and insufficient escaping when the link is output as the tile's href or followed by the lightbox. This makes it possible for authenticated attackers, with Author-level access and above, to store javascript: URLs in gallery image links that execute arbitrary script when a user clicks the image.",
 "plugin": {
  "slug": "modula-best-grid-gallery",
  "name": "Modula Image Gallery",
  "full_name": "Modula Image Gallery – Photo Grid & Video Gallery",
  "wordpress_org": "https://wordpress.org/plugins/modula-best-grid-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/modula-best-grid-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/modula-best-grid-gallery"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "3.0.18",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 3.0.18"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "3.0.18",
 "remediation": "Update to 3.0.18 or later.",
 "fix_released": "2026-11-06T13:00:40+00:00",
 "published": "2026-11-07T13:41:43+00:00",
 "updated": "2026-11-07T11:06:17.160380+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2717/",
  "https://plugins.svn.wordpress.org/modula-best-grid-gallery/tags/3.0.18/",
  "https://wordpress.org/plugins/modula-best-grid-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/modula-best-grid-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-07"
 }
}