CVE-2026-81154
UnknownSummary
The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
Risk Assessment
XSS attacks can lead to administrator session hijacking, data theft, or malware distribution across the organization.
Recommendation
Update the Robo Gallery plugin to version 5.2.6 or later, which includes the security fix.
Other vulnerabilities in Robo Gallery
See all- CVE-2026-81156Unknown
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
- CVE-2026-81155Unknown
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
- CVE-2026-81153Unknown
The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
- CVE-2026-105887Medium
Stored XSS vulnerability in Robo Gallery (up to 5.1.6) due to improper input neutralization.
- CVE-2026-4300Medium
The Robo Gallery plugin for WordPress up to version 5.1.3 is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting. The plugin uses a `|***...***|` marker pattern to embed raw JavaScript code within JSON configuration objects. Authenticated attackers with Author-level access can inject arbitrary scripts that execute whenever a page with the gallery is viewed.
Original NVD description (English source)
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS