WordPress security by component
Modula Image Gallery
Plugin description
Modula Image Gallery is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 23, 2026; the highest CVE/CNA score is 7.2.
Plugin slug:
modula-best-grid-galleryLatest vulnerability
CVE-2026-65475: Modula Image Gallery: Cross-site scripting
Modula Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is 2.14.25 through 2.14.30.
| Safe version |
|
||
|---|---|---|---|
| Jul 23, 2026 |
CVE-2026-65475
Modula Image Gallery: Cross-site scripting
Modula Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is 2.14.25 through 2.14.30.
|
2.14.31 |
CVE6.5
NVDPending
|
| Jun 15, 2026 |
CVE-2026-42688
Modula Image Gallery: Cross-site scripting
Modula Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.14.23.
|
2.14.24 |
CVE6.5
NVDPending
|
| Jun 15, 2026 |
CVE-2026-39481
Modula Image Gallery: Code execution
Modula Image Gallery is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 2.14.18.
|
2.14.19 |
CVE7.2
NVDPending
|
| Feb 03, 2026 |
CVE-2026-24939
Modula Image Gallery: A security weakness
Modula Image Gallery is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jan 22, 2026 |
CVE-2026-23976
Modula Image Gallery: Cross-site scripting
Modula Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVDPending
|
| Dec 12, 2025 |
CVE-2025-13891
Image Gallery – Photo Grid & Video Gallery: Filesystem traversal
Image Gallery – Photo Grid & Video Gallery is affected by filesystem traversal. Exploitation requires at least author-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Dec 03, 2025 |
CVE-2025-13645
Modula Image Gallery: Code execution
Modula Image Gallery is affected by code execution. Exploitation requires at least author-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Nov 15, 2025 |
CVE-2025-12494
Image Gallery – Photo Grid & Video Gallery: Arbitrary file deletion
Image Gallery – Photo Grid & Video Gallery is affected by arbitrary file deletion. Exploitation requires at least author-level access. A successful request can remove files outside the intended scope and may make the site unavailable.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Nov 18, 2022 |
CVE-2022-41135
Modula Best Grid Gallery: A security weakness
Modula Best Grid Gallery is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD5.3
|
| Feb 20, 2020 |
CVE-2020-9003
Modula Best Grid Gallery: Cross-site scripting
Modula Best Grid Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVD5.4
|