CVE-2026-65475
MediumCVSS 6.5Summary
The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.
Risk Assessment
The risk includes potential session theft, redirects to malicious sites, or credential theft through script execution in the victim's context.
Recommendation
It is recommended to update the Modula Image Gallery plugin to a version above 2.14.30 that includes a fix for the XSS vulnerability.
Other vulnerabilities in Modula Image Gallery
See all- CVE-2026-105876Medium
The Modula Image Gallery plugin for WordPress contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 3.0.11.
- CVE-2026-42688Medium
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
- CVE-2026-39481High
Modula Image Gallery versions up to 2.14.18 are vulnerable to PHP Object Injection, which may lead to unauthorized access to the system.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS