CVE-2026-121976

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the items parameter. The root cause is insufficient input sanitization of the per-image link field within the save_merged_items() REST handler and Images emA...