What is the CVSS score of CVE-2026-65475?

CVE-2026-65475 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Modula Image Gallery CVE-2026-65475

EUVD-2026-48250 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 audit@patchstack.com

GHSA-2654-6vph-g7x6

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects required contributor authentication; S:C captures cross-browser-context script execution; A:N because stored XSS does not materially impact service availability.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:31 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS.

This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

AnalysisAI

Stored Cross-Site Scripting in Modula Image Gallery WordPress plugin versions 2.14.25 through 2.14.30 allows an authenticated low-privileged user to inject persistent malicious scripts into gallery content, which execute in the browser of any higher-privileged user who views the affected page. The Scope:Changed CVSS metric confirms cross-context script execution, enabling session hijacking, credential theft, or administrator account takeover on vulnerable WordPress sites. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

The vulnerability is a Stored XSS flaw (CWE-79) in the Modula Image Gallery plugin developed by WP Chill for WordPress. Stored XSS arises when user-supplied input - such as gallery captions, titles, or custom HTML fields - is persisted to the WordPress database without adequate sanitization and later rendered in page HTML without proper output encoding. The CVSS Scope:Changed value confirms that the injected script escapes the plugin's processing context and executes within the victim's browser security context, a defining characteristic of reflected and stored XSS in web applications. The affected plugin slug is 'modula-best-grid-gallery' as identified in the Patchstack advisory reference. No CPE strings were included in the provided intelligence.

RemediationAI

Update the Modula Image Gallery plugin to a version beyond 2.14.30 once a patched release is confirmed available - the exact patched version number was not included in the provided data and cannot be independently verified; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/modula-best-grid-gallery/vulnerability/wordpress-modula-image-gallery-plugin-2-14-25-2-14-30-cross-site-scripting-xss-vulnerability?_s_id=cve for the latest patch status. As an interim control, restrict gallery creation and editing capabilities exclusively to trusted administrator accounts, removing contributor or editor access from any untrusted users, which eliminates the PR:L attack vector entirely. Deploying a Content Security Policy (CSP) header with a strict script-src directive can limit the damage from XSS execution by preventing unauthorized script sources, though this does not remediate the underlying injection flaw and may break legitimate plugin functionality if not carefully tuned. For high-value sites, deactivating the plugin until a confirmed patched version is released is the safest compensating control.