This vulnerability (CVE-2026-42688) in WP Chill's Modula Image Gallery plugin is a CWE-79 type cross-site scripting issue. It affects versions up to and including 2.14.23 and allows users with subscriber privileges to inject malicious scripts because input is not properly sanitized during page generation. The CVSS 3.1 score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user data, manipulate content, or disrupt availability. The impact is limited to users with subscriber privileges and requires user interaction, but the vulnerability affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting subscriber privileges or applying web application firewall (WAF) rules to detect and block XSS attempts related to this plugin.