The vulnerability is a stored cross‑site scripting flaw that allows an attacker to insert and execute arbitrary JavaScript code in the context of the Robo Gallery plugin. The flaw is caused by insufficient input sanitization, as indicated by the CWE‑79 identifier. When exploited, malicious scripts are rendered to all visitors of a gallery page, potentially leading to theft of user sessions, defacement, or redirection to malicious sites. The primary impact is the compromise of confidentiality, integrity, and availability of the web application for affected users.

Robosoft Robo Gallery plugin versions up to and including 5.1.6 are impacted. The vulnerability exists in all releases from the earliest supported version through 5.1.6. Users running this plugin on any WordPress installation should treat themselves as exposed.

The CVSS score of 6.5 indicates moderate severity, and there is no EPSS score available, so the exploitation probability is unclear. The vulnerability is listed in CISA’s KEV catalog as not listed, meaning no known exploited instance has been reported. The likely attack vector is remote, through the web interface that accepts user‑supplied data to build gallery pages. An attacker can exploit the stored XSS by injecting a payload that is then displayed to any visitor of the compromised gallery. The attack does not require privileged access and can affect all users who view the gallery. Given the moderate CVSS score and the absence of an EPSS value, the risk remains significant but not immediate; however, the existence of a straightforward plug‑in upgrade path mitigates the threat if acted upon promptly.