WordPress Plugin Vulnerabilities

Modula Image Gallery – Photo Grid & Video Gallery < 2.14.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.14.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
modula-best-grid-gallery
Fixed in 2.14.24

References

CVE
CVE-2026-42688
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/49ef0bfe-9bdf-4117-81f7-1ec73b5247ae

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
No
WPVDB ID
e51c9e36-bd6a-4d4f-a6b2-93b3b625b76e

Timeline

Publicly Published
2026-05-26 (about 2 months ago)
Added
2026-06-01 (about 1 month ago)
Last Updated
2026-06-01 (about 1 month ago)

Other

Published
Title
Published
2025-04-17
Title
Modal Survey <= 2.0.2.0.1 - Reflected Cross-Site Scripting
Published
2025-05-09
Title
Jeg Elementor Kit < 2.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets
Published
2025-01-16
Title
LJ Custom Menu Links <= 2.5 - Reflected Cross-Site Scripting
Published
2025-09-22
Title
Zoho Billing <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-03-03
Title
Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS