The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin is affected by a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This issue exists in the bundled FancyBox JavaScript library (versions <= 5.0.36) used by the plugin, where user-supplied attributes are not properly sanitized or escaped. As a result, authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability.

Successful exploitation allows authenticated users with contributor-level or higher access to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the context of other users viewing the pages, potentially leading to information disclosure or manipulation of content. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit contributor-level access to trusted users only and consider disabling or replacing the affected plugin to mitigate risk. Monitor official wpchill communications for updates and apply patches promptly once available.