The Modula Image Gallery plugin for WordPress suffers from an improper neutralization of user input that leads to stored cross‑site scripting. The flaw permits an attacker to embed malicious scripts through the gallery management interface, and those scripts are subsequently rendered unescaped on gallery pages. When executed in the browser of any visitor to the affected page, the code can steal session cookies, deface the site, or inject further malicious content.

Every instance of the Modula Image Gallery plugin provided by WP Chill that is version 2.13.4 or older is vulnerable. The plugin is widely distributed through the WordPress plugin repository and is used to display image galleries on sites that allow gallery creation and editing by privileged users.

The base CVSS score of 5.9 places the flaw in the medium severity range. EPSS indicates exploitation probability below 1 %. The vulnerability is not listed in the CISA KEV catalog. Attackers presumably need legitimate access to the gallery editing interface, such as an authenticated administrator or a user with editing rights, to inject the malicious payload. Once stored, the XSS can be activated whenever any user loads a gallery page, exposing all visitors to the associated risks.