Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS.

This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Published: 2026-07-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A legacy Modula Image Gallery plugin (versions 2.14.25–2.14.30) contains improper input neutralization that permits an attacker to inject arbitrary HTML or JavaScript into pages viewed by site visitors. This is a Stored XSS vulnerability (CWE-79). The impact is that any user viewing the gallery content could have malicious scripts executed in their browser. The provided text does not specify additional outcomes beyond script execution.

Affected Systems

WordPress sites that have installed the Modula Image Gallery plugin from version 2.14.25 through 2.14.30 are vulnerable. The plugin is distributed by WP Chill under the product name Modula Image Gallery. No other products or versions are known to be affected.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply malicious input into a gallery field that is later rendered without proper escaping, so an active attacker must have some ability to contribute or modify gallery content. This requirement is inferred from the stored nature of the XSS flaw.

Generated by OpenCVE AI on August 3, 2026 at 21:35 UTC.

Remediation

Vendor Solution

Update the WordPress Modula Image Gallery Plugin to the latest available version (at least 2.14.31).

OpenCVE Recommended Actions

  • Apply the official plugin update to version 2.14.31 or later, which removes the XSS flaw.
  • If the update cannot be performed immediately, disable or replace the gallery feature temporarily or restrict editing rights to trusted users only, ensuring no new unvalidated content can be added.
  • Implement a site‑wide content security policy that blocks or limits the execution of inline scripts, providing an additional layer of defense against residual XSS.

Generated by OpenCVE AI on August 3, 2026 at 21:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpchill
Wpchill modula Image Gallery
Vendors & Products Wordpress
Wordpress wordpress
Wpchill
Wpchill modula Image Gallery

Thu, 23 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Title WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
Wpchill Modula Image Gallery
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-23T15:47:33.645Z

Reserved: 2026-07-22T08:53:30.834Z

Link: CVE-2026-65475

cve-icon Vulnrichment

Updated: 2026-07-23T15:47:30.834Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T12:18:40.350

Modified: 2026-07-23T16:17:50.797

Link: CVE-2026-65475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T21:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')