WordPress plugin
Modula Image Gallery – Photo Grid & Video Gallery security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High8
- Medium13
- Low1
All Modula Image Gallery – Photo Grid & Video Gallery vulnerabilities
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter
≤3.0.17Update to 3.0.18
- High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
≤3.0.11Update to 3.0.12
- Medium5.3Unauthenticated Information Exposure
≤3.0.11Update to 3.0.12
- High7.5Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
≤3.0.1Update to 3.0.2
- High8.1Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
≤3.0.2Update to 3.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
2.14.25 – 2.14.30Update to 2.14.31
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.14.23Update to 2.14.24
- High7.5Authenticated (Author+) PHP Object Injection
≤2.14.18Update to 2.14.19
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
≤2.13.6Update to 2.13.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤2.13.4Update to 2.13.5
- Medium4.3Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification
≤2.13.3Update to 2.13.4
- Medium6.5Missing Authorization to Arbitrary Directory Listing
≤2.13.3Update to 2.13.4
- High7.52.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
2.13.1 – 2.13.2Update to 2.13.3
- High7.22.13.2 - Authenticated (Author+) Arbitrary File Deletion
2.13.1 – 2.13.2Update to 2.13.3
- Medium4.3Missing Authorization
≤2.13.6Update to 2.13.7
- Medium4.3Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
≤2.12.28Update to 2.12.29
- Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library
≤2.10.1Update to 2.10.2
- High8.8Authenticated (Author+) Arbitrary File Upload
≤2.11.10Update to 2.11.11
- Low2.2Incomplete Authorization via 'save_image' and 'save_images'
<2.7.5Update to 2.7.5
- High7.5Missing Authorization to Plugin Settings Change
≤2.6.9Update to 2.6.91
- Medium6.1Reflected Cross-Site Scripting
≤2.6.6Update to 2.6.7
- Medium6.4Authenticated Stored Cross-Site Scripting
<2.2.5Update to 2.2.5
Modula Image Gallery – Photo Grid & Video Gallery: common questions
Does Modula Image Gallery – Photo Grid & Video Gallery have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in Modula Image Gallery – Photo Grid & Video Gallery: 8 high, 13 medium, 1 low. None are known to affect version null.
How do I check which version of Modula Image Gallery – Photo Grid & Video Gallery I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Modula Image Gallery – Photo Grid & Video Gallery vulnerability?
CVE-2026-121976, published Nov 6, 2026: Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter. Severity: Medium (CVSS 6.4).
Is any Modula Image Gallery – Photo Grid & Video Gallery vulnerability listed in CISA KEV?
No. None of the known Modula Image Gallery – Photo Grid & Video Gallery vulnerabilities is currently listed in the CISA KEV catalog.