Skip to content
Noroxi

Modula Image Gallery – Photo Grid & Video Gallery

modula-best-grid-gallery · plugin

Known security vulnerabilities for Modula Image Gallery – Photo Grid & Video Gallery. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

2 exploitable without logging in · latest Sep 25, 2026

Listed on wordpress.org · latest 3.0.11 · last updated Sep 29, 2026 · 100K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2024-12853author+≤ 2.11.10

    Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload

    High 8.8

  • CVE-2026-92713author+≤ 3.0.2

    Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

    High 8.1

  • CVE-2026-89406unauthenticated≤ 3.0.1

    Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Paramete

    High 7.5

  • CVE-2026-39481author+≤ 2.14.18

    WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability

    High 7.2

  • CVE-2025-13645author+≤ 2.13.2

    Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion

    High 7.2

  • CVE-2025-13646author+≤ 2.13.2

    Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition

    Medium 6.6

  • CVE-2026-65475login required≤ 2.14.30

    WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-42688subscriber+≤ 2.14.23

    WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2025-13891author+≤ 2.13.3

    Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing

    Medium 6.5

  • CVE-2026-23976high privilege≤ 2.13.4

    WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability

    Medium 5.9

  • CVE-2020-9003login required

    A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress.

    Medium 5.4

  • CVE-2024-9416contributor+≤ 2.10.1

    Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library

    Medium 5.4

  • CVE-2022-41135unauthenticated≤ 2.6.9

    WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability

    Medium 5.3

  • CVE-2026-24939login required≤ 2.13.6

    WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2026-1254contributor+≤ 2.13.6

    Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing

    Medium 4.3

  • CVE-2025-14003author+≤ 2.13.3

    Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification

    Medium 4.3

  • CVE-2025-12494author+≤ 2.12.28

    Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory