CVE-2026-81153
UnknownSummary
The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
Risk Assessment
The vulnerability allows script injection that can hijack administrator sessions or steal data, even in multisite environments with restricted permissions.
Recommendation
Update the Robo Gallery plugin to version 5.2.6 or later, which includes the security fix.
Other vulnerabilities in Robo Gallery
See all- CVE-2026-81156Unknown
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
- CVE-2026-81155Unknown
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
- CVE-2026-81154Unknown
The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
- CVE-2026-105887Medium
Stored XSS vulnerability in Robo Gallery (up to 5.1.6) due to improper input neutralization.
- CVE-2026-4300Medium
The Robo Gallery plugin for WordPress up to version 5.1.3 is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting. The plugin uses a `|***...***|` marker pattern to embed raw JavaScript code within JSON configuration objects. Authenticated attackers with Author-level access can inject arbitrary scripts that execute whenever a page with the gallery is viewed.
Original NVD description (English source)
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS