CVE-2026-121976
Deferred Deferred - Pending Action

Stored XSS in Modula WordPress Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save_merged_items() REST handler and Images\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the gallery tile.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-121976
EUVD
EUVD-2026-119155

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpchill Modula Image Gallery – Photo Grid & Video Gallery From 0 (inc) to 3.0.17 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Modula plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability in versions up to 3.0.17. This flaw allows authenticated attackers with Author-level access or higher to inject malicious scripts via the 'items' parameter. The issue stems from insufficient input sanitization in the 'link' field of images, which preserves unknown keys. When combined with weak output escaping in the plugin, this enables execution of arbitrary web scripts when users interact with infected gallery tiles.

Detection Guidance

Check for the Modula plugin version 3.0.17 or lower in WordPress. Inspect WordPress REST API logs for suspicious 'items' parameter inputs containing 'javascript:' URLs in the 'link' field. Review stored XSS payloads in gallery tiles or pages.

Impact Analysis

If you use the vulnerable Modula plugin, attackers could inject malicious scripts into your WordPress site. These scripts may steal user data, hijack sessions, or redirect visitors to harmful sites. Users clicking infected gallery tiles could unknowingly execute these scripts, compromising their devices or accounts. The attack requires Author-level access, limiting impact to users with such privileges.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. If exploited, it may expose personal or sensitive information, resulting in regulatory fines, legal liabilities, and reputational damage. Organizations must patch the plugin promptly to maintain compliance.

Mitigation Strategies
  • Update the Modula plugin to the latest version immediately to patch the vulnerability.
  • Remove or disable the Modula plugin if an update is not available.
  • Audit WordPress user roles to ensure only trusted users have Author-level access or higher.
  • Scan your WordPress site for injected scripts or malicious links in gallery tiles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...