CVE-2026-81155
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
Risk Assessment
An attacker can execute malicious script in the browsers of all site visitors, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the Robo Gallery plugin to version 5.2.6 or later, which includes security fixes. Additionally, restrict user privileges and apply the principle of least privilege.
Other vulnerabilities in Robo Gallery
See all- CVE-2026-105887Medium
Stored XSS vulnerability in Robo Gallery (up to 5.1.6) due to improper input neutralization.
- CVE-2026-81156Medium
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
- CVE-2026-81154Medium
The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
- CVE-2026-81153Medium
The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
- CVE-2026-4300Medium
The Robo Gallery plugin for WordPress up to version 5.1.3 is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting. The plugin uses a `|***...***|` marker pattern to embed raw JavaScript code within JSON configuration objects. Authenticated attackers with Author-level access can inject arbitrary scripts that execute whenever a page with the gallery is viewed.
Original NVD description (English source)
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS