The Robo Gallery WordPress plugin before version 5.2.6 fails to sanitize and escape several image settings when rendering a gallery page, which allows a user with Author privileges or higher to inject malicious JavaScript into the image overlay effect metadata. When a visitor, including administrators, opens the affected gallery page, the injected code is executed in the browser, potentially enabling session hijacking, data theft, defacement or phishing. This stored cross‑site scripting flaw requires only that the attacker can edit image settings; it is not limited by site architecture such as multisite, because unfiltered_html permission is not needed for exploitation.

The vulnerability affects any WordPress installation that has the Robo Gallery plugin version 5.2.5 or earlier. All users with at least Author role who are able to modify image settings can leverage this flaw on sites that have published galleries. The plugin is distributed through the WordPress.org repository, and every site that has an affected version and author‑level access is included.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is less than 1%, indicating a low probability of exploitation, while the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker with author access will edit the image overlay metadata, save the changes, and any visitor to that gallery will trigger the malicious script. The risk level is moderate to high for sites that display galleries publicly and that allow authors to edit image settings; the impact is confined to the browsers of visitors, with no direct remote code execution on the server itself.