CVE-2026-121976

The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the items parameter. The root cause is insufficient input sanitization of the per-image link field within the save_merged_items() REST handler and Images emA...

EUVD-2026-119155

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the savemergeditems REST handler and Images\Adapter::normalizeitemrow,...