WordPress plugin

Modula Image Gallery – Photo Grid & Video Gallery security & vulnerabilities

Q: Is any Modula Image Gallery – Photo Grid & Video Gallery vulnerability listed in CISA KEV?

No. None of the known Modula Image Gallery – Photo Grid & Video Gallery vulnerabilities is currently listed in the CISA KEV catalog.

modula-best-grid-gallery— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

22Known vulnerabilities

Critical0
High8
Medium13
Low1

Vulnerabilities per year

All Modula Image Gallery – Photo Grid & Video Gallery vulnerabilities

Modula Image Gallery – Photo Grid & Video Gallery vulnerabilities
Severity	Vulnerability	CVE	Published
High7.5	Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT ≤3.0.11Update to 3.0.12	CVE-2026-107659	Oct 15
High7.5	Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters ≤3.0.1Update to 3.0.2	CVE-2026-89406	Sep 24
High8.1	Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter ≤3.0.2Update to 3.0.3	CVE-2026-92713	Sep 24
High7.5	Authenticated (Author+) PHP Object Injection ≤2.14.18Update to 2.14.19	CVE-2026-39481	Apr 20
High7.5	2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition 2.13.1 – 2.13.2Update to 2.13.3	CVE-2025-13646	Dec 2, 2025
High7.2	2.13.2 - Authenticated (Author+) Arbitrary File Deletion 2.13.1 – 2.13.2Update to 2.13.3	CVE-2025-13645	Dec 2, 2025
High8.8	Authenticated (Author+) Arbitrary File Upload ≤2.11.10Update to 2.11.11	CVE-2024-12853	Jan 7, 2025
High7.5	Missing Authorization to Plugin Settings Change ≤2.6.9Update to 2.6.91	CVE-2022-41135	Oct 28, 2022

High7.5
Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
≤3.0.11Update to 3.0.12
CVE-2026-107659Oct 15
High7.5
Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
≤3.0.1Update to 3.0.2
CVE-2026-89406Sep 24
High8.1
Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
≤3.0.2Update to 3.0.3
CVE-2026-92713Sep 24
High7.5
Authenticated (Author+) PHP Object Injection
≤2.14.18Update to 2.14.19
CVE-2026-39481Apr 20
High7.5
2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
2.13.1 – 2.13.2Update to 2.13.3
CVE-2025-13646Dec 2, 2025
High7.2
2.13.2 - Authenticated (Author+) Arbitrary File Deletion
2.13.1 – 2.13.2Update to 2.13.3
CVE-2025-13645Dec 2, 2025
High8.8
Authenticated (Author+) Arbitrary File Upload
≤2.11.10Update to 2.11.11
CVE-2024-12853Jan 7, 2025
High7.5
Missing Authorization to Plugin Settings Change
≤2.6.9Update to 2.6.91
CVE-2022-41135Oct 28, 2022

Modula Image Gallery – Photo Grid & Video Gallery: common questions

Does Modula Image Gallery – Photo Grid & Video Gallery have known vulnerabilities?

Yes. VulnCrest Radar lists 22 known vulnerabilities in Modula Image Gallery – Photo Grid & Video Gallery: 8 high, 13 medium, 1 low. None are known to affect version null.

How do I check which version of Modula Image Gallery – Photo Grid & Video Gallery I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Modula Image Gallery – Photo Grid & Video Gallery vulnerability?

CVE-2026-121976, published Nov 6, 2026: Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter. Severity: Medium (CVSS 6.4).

Is any Modula Image Gallery – Photo Grid & Video Gallery vulnerability listed in CISA KEV?

No. None of the known Modula Image Gallery – Photo Grid & Video Gallery vulnerabilities is currently listed in the CISA KEV catalog.