What is the CVSS score of CVE-2026-42688?

CVE-2026-42688 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Modula Image Gallery CVE-2026-42688

EUVD-2026-36836 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-cq6v-9fx8-4hwq

XSS Modula Image Gallery

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber auth required (PR:L), admin must view content (UI:R), scope changes to victim browser (S:C); no direct availability impact from XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:58 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

AnalysisAI

Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.

Technical ContextAI

Modula Image Gallery is a WordPress plugin developed by WP Chill (CPE: cpe:2.3:a:wp_chill:modula_image_gallery:*:*:*:*:*:*:*:*) that provides customizable image grid and gallery functionality. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML output. Because the CVSS vector indicates PR:L (low privilege required) and S:C (scope change), this is consistent with a stored XSS pattern where subscriber-tier input persists in the database and is later rendered in the browser session of other users, including administrators. The WordPress subscriber role is the lowest authenticated role and is often openly available via public registration.

RemediationAI

The primary fix is to update the Modula Image Gallery plugin to a version beyond 2.14.23, which should include the XSS sanitization fix. Site administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/modula-best-grid-gallery/vulnerability/wordpress-modula-image-gallery-plugin-2-14-23-cross-site-scripting-xss-vulnerability for the exact patched release version; a specific fixed version was not confirmed in the provided input data. As a compensating control where immediate patching is not possible, WordPress site administrators should disable public user registration to prevent unauthenticated visitors from obtaining the subscriber role required for exploitation. A Web Application Firewall (WAF) with XSS rulesets can provide partial mitigation by blocking known XSS payload patterns, though this should not be relied upon as a primary defense. Reviewing existing subscriber accounts for suspicious gallery content is also advisable.