Stored Cross-Site Scripting in Modula Plugin for WordPress

CVE-2026-121976

What is CVE-2026-121976?

The Modula plugin for WordPress is susceptible to Stored Cross-Site Scripting. The vulnerability stems from inadequate input sanitization of the 'link' field within the save_merged_items() REST handler and Images\Adapter::normalize_item_row(). Attackers with Author-level access can exploit this flaw to inject malicious scripts into pages, which will execute when users access the affected content. This is compounded by the output escaping in Modula_Helper::generate_attributes(), which fails to adequately handle the 'javascript:' URL scheme, allowing attackers to craft URLs that compromise user security.

References