CVE-2026-121976: Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

Q: Who can exploit this issue?

An authenticated WordPress user with Author-level access or higher can exploit it. The attacker needs the ability to submit gallery item data through the affected REST handling path.

Q: When does the injected script execute?

The script executes when someone visits a page containing the injected gallery and clicks the affected gallery tile. Merely loading the page is not described as sufficient.

Q: What input is involved in the attack?

The attack uses the items parameter, specifically a per-image link field. A javascript: URL can be retained and rendered into the gallery tile's anchor href.

Q: How can I check for possible exploitation?

Review gallery item link values for unexpected or malicious javascript: URLs, especially in galleries created or edited by Author-level users. Check pages containing those galleries because execution requires a visitor to click the affected tile.

Published Nov 7, 2026

Updated

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the savemergeditems() REST handler and Images\Adapter::normalizeitemrow(), which preserves unknown keys verbatim, combined with output escaping in ModulaHelper::generateattributes() that applies only escattr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile.

Event History

Nov 7, 2026

CVE Published

via MITRE·11:26 AM

Data Sourced

via MITRE·11:26 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with Author-level access or higher can exploit it. The attacker needs the ability to submit gallery item data through the affected REST handling path.

When does the injected script execute?

The script executes when someone visits a page containing the injected gallery and clicks the affected gallery tile. Merely loading the page is not described as sufficient.

What input is involved in the attack?

The attack uses the items parameter, specifically a per-image link field. A javascript: URL can be retained and rendered into the gallery tile's anchor href.

How can I check for possible exploitation?

Review gallery item link values for unexpected or malicious javascript: URLs, especially in galleries created or edited by Author-level users. Check pages containing those galleries because execution requires a visitor to click the affected tile.

CVE-2026-121976: Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the injected script execute?

What input is involved in the attack?

How can I check for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the injected script execute?

What input is involved in the attack?

How can I check for possible exploitation?