Vulnerability record · CVE-2020-9003 · published 20 February 2020
CVE-2020-9003: Wpchill modula image gallery cross-site scripting vulnerability
Wpchill · Modula Image Gallery
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
Description
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://fortiguard.com/zeroday/FG-VD-20-041 | Third Party Advisory |
| https://github.com/MachoThemes/modula-lite/blob/master/changelog.txt | Release NotesThird Party Advisory |
| https://wordpress.org/plugins/modula-best-grid-gallery/ | Vendor Advisory |
| https://wpvulndb.com/vulnerabilities/10077 | Third Party Advisory |
| https://fortiguard.com/zeroday/FG-VD-20-041 | Third Party Advisory |
| https://github.com/MachoThemes/modula-lite/blob/master/changelog.txt | Release NotesThird Party Advisory |
| https://wordpress.org/plugins/modula-best-grid-gallery/ | Vendor Advisory |
| https://wpvulndb.com/vulnerabilities/10077 | Third Party Advisory |
Track CVE-2020-9003 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-9003), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
