CVE-2026-42688
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update Modula Image Gallery to the latest version to mitigate this vulnerability.
Other vulnerabilities in Modula Image Gallery
See all- CVE-2026-65475Medium
The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2026-39481High
Modula Image Gallery versions up to 2.14.18 are vulnerable to PHP Object Injection, which may lead to unauthorized access to the system.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.