CVE-2026-121976

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the savemergeditems REST handler and Images\Adapter::normalizeitemrow,...

CVE-2026-121976

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the items parameter. The root cause is insufficient input sanitization of the per-image link field within the save_merged_items() REST handler and Images emA...

EUVD-2026-119155

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the savemergeditems REST handler and Images\Adapter::normalizeitemrow,...

CVE-2026-121976 Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the savemergeditems REST handler and Images\Adapter::normalizeitemrow,...

PT-2026-139442

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save merged items REST handler and ImagesAdapter::normalize item row,...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Modula Image Gallery versions = 3.0.17...

CVE-2026-107659

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

CVE-2026-107659 Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

EUVD-2026-102654

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

CVE-2026-107659

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.0.11 . The root cause is a missing authorization check on the core /wp-json/wp/v2/modula-gallery/{id} path, which is exposed via show_in...

CVE-2026-107659 Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

PT-2026-115425

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

CVE-2026-107659: Missing Authorization

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin Modula Image Gallery versions = 3.0.11...

WordPress Modula Image Gallery Authorization Issue Vulnerability

WordPress Modula Image Gallery 3.0.11 and earlier versions have a vulnerability related to authorization. This vulnerability arises when accessing via the /wp-json/wp/v2/modula-gallery/id URL, where the id parameter is set to “none”. As a result, sensitive information in the modulaSettings REST...

CVE-2026-105876

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

EUVD-2026-94258

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

CVE-2026-105876

The WordPress Modula Image Gallery plugin (versions up to and including 3.0.11 ) contains a Missing Authorization vulnerability (CWE-862) within the modula-best-grid-gallery component. This flaw allows an attacker to Retrieve Embedded Sensitive Data from the plugin. No specific remediation steps ...

CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...