The Robo Gallery WordPress plugin fails to escape image alt attributes before rendering them in gallery layouts, allowing an attacker with the Author role or higher to inject arbitrary JavaScript into the alt text of an uploaded image. When a victim opens the gallery, the malicious script executes in the victim’s browser, enabling session hijacking, defacement, or phishing. The vulnerability is classified as CWE‑79.

All WordPress installations that use Robo Gallery before version 5.2.6 are affected. The issue appears in the gallery view that displays image alt text; sites that have upgraded to 5.2.6 or later are no longer vulnerable.

With a CVSS score of 6.8 the flaw represents moderate severity, while an EPSS score of less than 1 % indicates a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Attackers must be authenticated as an Author or higher, a role commonly available to many site contributors. Once logged in, the attacker can upload or edit an image with malicious alt text; any visitor to the gallery will then have the payload executed in their browser. The flaw therefore allows malicious code execution within the context of the website and can be leveraged for further lateral moves if higher privileges are later obtained.