CVE-2026-121976 Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121976?
CVE-2026-121976 is a medium-severity vulnerability in wpchill Modula Image Gallery – Photo Grid & Video Gallery, published on 7 Nov 2026.
Official description
The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save_merged_items() REST handler and Images\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile.
Weakness: CWE-79
Which versions are affected by CVE-2026-121976?
How do I fix CVE-2026-121976?
No fix has been published for CVE-2026-121976 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121976 being exploited?
There is no known exploitation of CVE-2026-121976 in the wild and no public exploit code.
Sources
Also known as GHSA-g6pv-q7rc-97m5.