Quick answers
- Is CVE-2026-65475 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-65475 being exploited in the wild.
- How severe is CVE-2026-65475?
- Medium severity, with a CVSS score of 6.5, published 23 July 2026.
- Which products and versions are affected?
- WP Chill Modula Image Gallery 2.14.25 through 2.14.30.
- Is there a fix for CVE-2026-65475?
- A patch was published on 2026-07-23: Patch available in version 2.14.31 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-65475 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-65475?
- Check whether you run WP Chill Modula Image Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WP Chill Modula Image Gallery plugin for WordPress (versions 2.14.25 through 2.14.30). The flaw stems from improper neutralization of user-supplied input during web page generation, allowing an attacker with 'Contributor' or higher privileges to inject malicious scripts into gallery components. These scripts are then executed in the browser of any user (including administrators) who views the affected page. Exploitation requires minimal user interaction, such as a victim visiting the page where the malicious payload is stored. The issue is resolved in version 2.14.31.
Affected products
- WP Chill Modula Image Gallery 2.14.25 through 2.14.30
Timeline
- 2026-07-17: other: Reported by Abdullah Kareem
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: NVD publication date
- 2026-07-23: patched: Patch available in version 2.14.31