CVE-2026-65475

MediumCVSS 6.5

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.

Risk Assessment

The risk includes potential session theft, redirects to malicious sites, or credential theft through script execution in the victim's context.

Recommendation

It is recommended to update the Modula Image Gallery plugin to a version above 2.14.30 that includes a fix for the XSS vulnerability.

Other vulnerabilities in Modula Image Gallery

See all

CVE-2026-42688Medium
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
CVE-2026-39481High
Modula Image Gallery versions up to 2.14.18 are vulnerable to PHP Object Injection, which may lead to unauthorized access to the system.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.