CVE-2026-39481
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Modula Image Gallery versions up to 2.14.18 are vulnerable to PHP Object Injection, which may lead to unauthorized access to the system.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update Modula Image Gallery to the latest version to mitigate this vulnerability.
Other vulnerabilities in Modula Image Gallery
See all- CVE-2026-107659High
The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.11) is vulnerable to sensitive information exposure via the 'id' parameter in /wp-json/wp/v2/modula-gallery/{id}. An unauthenticated attacker can extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field.
- CVE-2026-65475Medium
The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2026-105876Medium
The Modula Image Gallery plugin for WordPress contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 3.0.11.
- CVE-2026-42688Medium
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
Original NVD description (English source)
Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS