The Modula plugin for WordPress contains a stored cross‑site scripting flaw in the per‑image 'link' field within the 'items' parameter. The defect stems from the REST handler and image adapter passing user‑supplied keys unchanged, while the output helper encodes only the anchor href with esc_attr(), leaving the 'javascript:' scheme intact. Consequently, an authenticated user with Author or higher privileges can inject arbitrary JavaScript into gallery pages. When a target user visits a page containing the gallery and interacts with the vulnerable tile, the embedded script runs in the context of the site, enabling attacks such as cookie theft, credential phishing, or further malicious activity.

This vulnerability affects the Modula Image Gallery – Photo Grid & Video Gallery plugin developed by wpchill, in any release up to and including version 3.0.17. The flaw resides in the core helpers and REST controller that handle gallery item storage for all WordPress installations that use this plugin version.

The CVSS score of 6.4 places the flaw in the medium‑severity range, and the EPSS score is not available, so the exact likelihood of exploitation remains unclear. The vulnerability is not catalogued in the CISA KEV list. Attackers need authenticated Author‑level access or higher to trigger the injection; therefore, the exploit requires prior compromise or privilege escalation. Nevertheless, once exploited, the injected script executes with the privileges of the visiting user, potentially compromising session integrity and site integrity for all site visitors.