CVE-2026-121976

Name of the Vulnerable Software and Affected Versions Modula versions prior to 3.0.18

Description Stored Cross-Site Scripting occurs via the items parameter. The issue stems from insufficient input sanitization of the per-image link field within the save merged items() REST handler and ImagesAdapter::normalize item row() function, which preserves unknown keys verbatim. Additionally, the Modula Helper::generate attributes() function applies only esc attr() to the resulting anchor href and fails to strip the javascript: URL scheme. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages that execute when a user clicks a gallery tile.

Recommendations Update to version 3.0.18 or later. As a temporary mitigation, restrict Author-level access to gallery settings to prevent the injection of malicious links in the items parameter.