CVE-2026-105876
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Modula Image Gallery plugin for WordPress contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 3.0.11.
Risk Assessment
An attacker may gain access to sensitive data stored in the gallery, potentially leading to privacy breaches or information leakage.
Recommendation
Update the Modula Image Gallery plugin to the latest version that includes the security fix.
Other vulnerabilities in Modula Image Gallery
See all- CVE-2026-65475Medium
The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2026-42688Medium
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
- CVE-2026-39481High
Modula Image Gallery versions up to 2.14.18 are vulnerable to PHP Object Injection, which may lead to unauthorized access to the system.
Original NVD description (English source)
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS