What is the CVSS score of EUVD-2026-41363?

EUVD-2026-41363 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Modula PRO are affected by EUVD-2026-41363?

Modula PRO WordPress gallery plugin (versions through 2.10.8) contains a cross-site scripting flaw that allows unauthenticated attackers to inject malicious code into websites, with no vendor patch…

How to fix or mitigate EUVD-2026-41363?

Within 24 hours: scan all WordPress installations to identify deployed instances of Modula PRO v2.10.8 or earlier; immediately deactivate and remove affected plugin versions. Within 7 days: deploy Content Security Policy headers and Web Application Firewall rules to block XSS payloads; review web logs for exploitation attempts. Within 30 days: replace Modula PRO with a patched alternative gallery solution; implement quarterly plugin security audits.

Modula PRO EUVD-2026-41363

| CVE-2026-57426 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-x2v5-rp8m-cc4j

WordPress XSS Wordpress Plugin Modula Pro

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (PR:N, AV:N, AC:L) requires victim interaction (UI:R) and executes across a trust boundary (S:C) with browser-scoped Low C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:18 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

AnalysisAI

Cross-site scripting in the Modula PRO WordPress gallery plugin (versions through 2.10.8) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they view or interact with attacker-influenced content. Reported by Patchstack and rated CVSS 7.1 with a scope change, the flaw requires user interaction but no authentication; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Modula is a commercial WordPress image and video gallery plugin developed by Chill Media Labs S.R.L. (CPE: cpe:2.3:a:chill_media_labs_s.r.l.:modula_-_pro), with the PRO edition adding premium gallery, filtering, and lightbox features on top of the widely installed free Modula plugin. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored into HTML output without adequate sanitization or output encoding, letting an attacker smuggle active script into a page rendered by the WordPress front end or admin context. The CVSS scope-change flag (S:C) reflects the classic XSS property that code injected into the vulnerable component executes under the security authority of the victim's browser session, crossing a trust boundary.

RemediationAI

Upgrade Modula PRO to the first fixed release above version 2.10.8 as published by the vendor; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/modula/vulnerability/wordpress-modula-pro-plugin-2-10-8-cross-site-scripting-xss-vulnerability) and the vendor's changelog for the exact patched version, since no specific fix version is confirmed in the available data. Until patched, compensating controls include deploying a WordPress-aware WAF or Patchstack's virtual patching to filter XSS payloads on the affected endpoints (trade-off: rule tuning may cause false positives on legitimate gallery input), tightening a Content-Security-Policy to disallow inline script execution (trade-off: may break other plugins or themes relying on inline JS), and restricting or monitoring the plugin's front-end input paths; if the plugin is non-essential, temporarily deactivating Modula PRO removes exposure entirely at the cost of gallery functionality.