Extension WordPress
Vulnérabilités Modula Image Gallery – Photo Grid & Video Gallery
Cette page rassemble les failles publiées pour Modula Image Gallery – Photo Grid & Video Gallery, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Modula Image Gallery – Photo Grid & Video Gallery
16 fiches
Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.23 – Authenticated (Subscriber+) Stored Cross-Site Scripting
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.14.23 due to insufficient input sanitization and output escaping. This makes it possible…
*-2.14.23
2.14.24
26/05/2026
Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.18 – Authenticated (Author+) PHP Object Injection
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.14.18 via deserialization of untrusted input. This makes it possible for authenticated attackers,…
*-2.14.18
2.14.19
20/04/2026
Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 – Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user…
*-2.13.6
2.13.7
13/02/2026
Modula Image Gallery <= 2.13.4 – Authenticated (Author+) Stored Cross-Site Scripting
The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access…
*-2.13.4
2.13.5
04/02/2026
Image Gallery – Photo Grid & Video Gallery <= 2.13.3 – Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This…
*-2.13.3
2.13.4
15/12/2025
Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 – Missing Authorization to Arbitrary Directory Listing
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation…
*-2.13.3
2.13.4
11/12/2025
Modula 2.13.1 – 2.13.2 – Authenticated (Author+) Arbitrary File Upload via Race Condition
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access…
2.13.1-2.13.2
2.13.3
02/12/2025
Modula 2.13.1 – 2.13.2 – Authenticated (Author+) Arbitrary File Deletion
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access…
2.13.1-2.13.2
2.13.3
02/12/2025
Modula Image Gallery <= 2.13.6 – Missing Authorization
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.13.6. This makes it…
*-2.13.6
2.13.7
22/11/2025
Image Gallery – Photo Grid & Video Gallery <= 2.12.28 – Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes…
*-2.12.28
2.12.29
14/11/2025
Modula Image Gallery <= 2.10.1 – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library
The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions
*-2.10.1
2.10.2
03/04/2025
Modula Image Gallery <= 2.11.10 – Authenticated (Author+) Arbitrary File Upload
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated…
*-2.11.10
2.11.11
07/01/2025
Modula <= 2.7.4 – Incomplete Authorization via 'save_image' and 'save_images'
The Modula plugin for WordPress is vulnerable to unauthorized modification of data due to an incomplete capability check on the 'save_image' and 'save_images' functions in versions up to, and including, 2.7.4. This makes it possible for authenticated attackers…
[*, 2.7.5)
2.7.5
10/09/2023
Customizable WordPress Gallery Plugin – Modula Image Gallery <= 2.6.9 – Missing Authorization to Plugin Settings Change
The Customizable WordPress Gallery Plugin – Modula Image Gallery plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the update_troubleshooting_options function in versions up to, and including, 2.6.9. This makes it possible…
*-2.6.9
2.6.91
28/10/2022
Modula Image Gallery <= 2.6.6 – Reflected Cross-Site Scripting
The Modula Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 2.6.6. This makes it possible for unauthenticated…
*-2.6.6
2.6.7
06/06/2022
Modula Image Gallery <= 2.2.4 – Authenticated Stored Cross-Site Scripting
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
[*, 2.2.5)
2.2.5
19/02/2020
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.