Vulnerabilidades do Wpchill Modula Image Gallery
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Wpchill Modula Image Gallery: 8 registro(s), com versões afetadas e correções.cpe:2.3:a:wpchill:modula_image_gallery
CVE-2026-105876
Média · 5.3
CWE-862 07/10/2026
WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
CVE-2026-65475
Média · 6.5
CWE-79 23/07/2026
WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS.
This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
CVE-2026-42688
Média · 6.5
CWE-79 15/06/2026
WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.
CVE-2026-39481
Alta · 7.2
CWE-502 15/06/2026
WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability
Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
CVE-2026-24939
Média · 4.3
CWE-862 03/02/2026
WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modula Image Gallery: from n/a through <= 2.13.6.
CVE-2026-23976
Média · 5.9
CWE-79 22/01/2026
WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This issue affects Modula Image Gallery: from n/a through <= 2.13.4.
CVE-2025-13646
Média · 6.6
CWE-434 03/12/2025
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.
CVE-2025-13645
Alta · 7.2
CWE-22 03/12/2025
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).