Modula Image Gallery – Photo Grid & Video Gallery

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Modula Image Gallery – Photo Grid & Video Gallery

Information

Software Type Plugin
Software Slug modula-best-grid-gallery (view on wordpress.org)
Software Status Active
Software Author wpchill
Software Website wp-modula.com
Software Downloads 6,793,488
Software Active Installs 100,000
Software Record Last Updated July 13, 2026

16 Vulnerabilities

Submit a Vulnerability
Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-42688
May 26, 2026
Researcher: Nguyen Ba Khanh
Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.18 - Authenticated (Author+) PHP Object Injection
7.5
CVE-2026-39481
Apr 20, 2026
Researcher: daroo
Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
4.3
CVE-2026-1254
Feb 13, 2026
Researcher: type5afe
Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2026-23976
Feb 4, 2026
Researcher: johska
Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification
4.3
CVE-2025-14003
Dec 15, 2025
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Powpy, Waris Damkham, Varakorn Chanthasri (iCreaM), Peerapat Samatathanyakorn, Sopon Tangpathum (SoNaJaa)
Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing
6.5
CVE-2025-13891
Dec 11, 2025
Researcher: Dmitrii Ignatyev
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
7.5
CVE-2025-13646
Dec 2, 2025
Researcher: 0xQRx
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion
7.2
CVE-2025-13645
Dec 2, 2025
Researcher: ISMAILSHADOW
Modula Image Gallery <= 2.13.6 - Missing Authorization
4.3
CVE-2026-24939
Nov 22, 2025
Researcher: Que Thanh Tuan
Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
4.3
CVE-2025-12494
Nov 14, 2025
Researcher: Dmitrii Ignatyev
Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library
6.4
CVE-2024-9416
Apr 2, 2025
Researcher: Webbernaut
Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload
8.8
CVE-2024-12853
Jan 7, 2025
Researcher: SavPhill (Savphill)
Modula <= 2.7.4 - Incomplete Authorization via 'save_image' and 'save_images'
2.2
CVE ID Unknown
Sep 10, 2023
Researchers:
Customizable WordPress Gallery Plugin – Modula Image Gallery <= 2.6.9 - Missing Authorization to Plugin Settings Change
7.5
CVE-2022-41135
Oct 28, 2022
Researcher: Nguyen Anh Tien
Modula Image Gallery <= 2.6.6 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Jun 6, 2022
Researchers:
Modula Image Gallery <= 2.2.4 - Authenticated Stored Cross-Site Scripting
6.4
CVE-2020-9003
Feb 19, 2020
Researcher: Vishnupriya Ilango
Title Status CVE ID CVSS Researchers Date
Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-42688 6.4 Nguyen Ba Khanh May 26, 2026
Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.18 - Authenticated (Author+) PHP Object Injection Patched CVE-2026-39481 7.5 daroo April 20, 2026
Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing Patched CVE-2026-1254 4.3 type5afe February 13, 2026
Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2026-23976 6.4 johska February 4, 2026
Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification Patched CVE-2025-14003 4.3 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Powpy, Waris Damkham, Varakorn Chanthasri (iCreaM), Peerapat Samatathanyakorn, Sopon Tangpathum (SoNaJaa) December 15, 2025
Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing Patched CVE-2025-13891 6.5 Dmitrii Ignatyev December 11, 2025
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition Patched CVE-2025-13646 7.5 0xQRx December 2, 2025
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion Patched CVE-2025-13645 7.2 ISMAILSHADOW December 2, 2025
Modula Image Gallery <= 2.13.6 - Missing Authorization Patched CVE-2026-24939 4.3 Que Thanh Tuan November 22, 2025
Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move Patched CVE-2025-12494 4.3 Dmitrii Ignatyev November 14, 2025
Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library Patched CVE-2024-9416 6.4 Webbernaut April 2, 2025
Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload Patched CVE-2024-12853 8.8 SavPhill (Savphill) January 7, 2025
Modula <= 2.7.4 - Incomplete Authorization via 'save_image' and 'save_images' Patched 2.2 September 10, 2023
Customizable WordPress Gallery Plugin – Modula Image Gallery <= 2.6.9 - Missing Authorization to Plugin Settings Change Patched CVE-2022-41135 7.5 Nguyen Anh Tien October 28, 2022
Modula Image Gallery <= 2.6.6 - Reflected Cross-Site Scripting Patched 6.1 June 6, 2022
Modula Image Gallery <= 2.2.4 - Authenticated Stored Cross-Site Scripting Patched CVE-2020-9003 6.4 Vishnupriya Ilango February 19, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation