A setting of the Robo Gallery WordPress plugin is rendered unsanitised on a public gallery page. Users with the Author role and higher can insert HTML or JavaScript into that setting, which is stored and later delivered to any visitor. When the gallery page loads, the injected code executes in the visitor’s browser, allowing attackers to steal session cookies, deface the site, or perform further client‑side actions. The weakness falls under the category of input improperly neutralised before outputting to a web page.

The vulnerability resides in the Robo Gallery plugin for WordPress. All WordPress installations using Robo Gallery before version 5.2.6 are affected; the plugin lacks version information beyond the 5.2.6 threshold. The issue arises under settings accessed by users with the Author role or higher.

The vulnerability enables stored cross‑site scripting on gallery pages. Users with the Author role or higher can insert unsanitised HTML or JavaScript into a gallery setting that is subsequently displayed to anyone visiting the gallery. When the page loads, the malicious code executes in the victim’s browser, allowing the attacker to read or modify the page content, steal session cookies, deface the site, or conduct other client‑side attacks. The CVSS score is 6.8, EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers must manipulate the gallery label via the WordPress admin interface and then persuade a victim to view the gallery page for the payload to execute.