# Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Image Link

- **ID:** WPSEC-2026-2717
- **Plugin:** Modula Image Gallery – Photo Grid & Video Gallery (`modula-best-grid-gallery`), https://wordpress.org/plugins/modula-best-grid-gallery/
- **Affected versions:** from 3.0.0 before 3.0.18
- **Fixed in:** 3.0.18 (Update to 3.0.18 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/modula-best-grid-gallery
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2717/

## Description

The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery image link (Custom URL) of Beta galleries in versions 3.0.0 up to, and including, 3.0.17, due to insufficient validation of the URL scheme when items are saved through the save-merged-items REST endpoint, and insufficient escaping when the link is output as the tile's href or followed by the lightbox. This makes it possible for authenticated attackers, with Author-level access and above, to store javascript: URLs in gallery image links that execute arbitrary script when a user clicks the image.

## References

- https://wpsec.com/vuln/WPSEC-2026-2717/
- https://plugins.svn.wordpress.org/modula-best-grid-gallery/tags/3.0.18/
- https://wordpress.org/plugins/modula-best-grid-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2717/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.