Description
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
Published: 2026-10-11
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored XSS via gallery settings
Action: Upgrade
AI Analysis

Impact

Robo Gallery WordPress plugin versions prior to 5.2.6 fail to sanitise and escape gallery settings before rendering them on the gallery edit screen. This flaw allows users with the Contributor role or higher to embed JavaScript that runs in the browser context of any administrator who opens the gallery for editing.

Affected Systems

All WordPress sites that install Robo Gallery before the 5.2.6 release are vulnerable. The vulnerability exists regardless of the number of galleries configured.

Risk and Exploitability

The CVE has a CVSS score of 6.8, and the EPSS metric is not available. The flaw is not listed in the CISA KEV catalog. The stored XSS can only be triggered when a user with sufficient role edits a gallery, which requires an administrator to access the gallery edit screen. The exploitability depends on the presence of a Contributor or higher role and on an administrator viewing the edit page. Based on the description, the flaw does not allow arbitrary code execution outside the browser context.

Generated by OpenCVE AI on October 11, 2026 at 14:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Robo Gallery to version 5.2.6 or later
  • If upgrade is not immediately possible, restrict or remove the Contributor role’s permissions for editing gallery settings
  • Configure a Web Application Firewall or apply a Content Security Policy to block unintended script execution

Generated by OpenCVE AI on October 11, 2026 at 14:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Sun, 11 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
Title Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-11T11:32:46.093Z

Reserved: 2026-08-26T16:18:24.473Z

Link: CVE-2026-81156

cve-icon Vulnrichment

Updated: 2026-10-11T11:26:36.001Z

cve-icon NVD

Status : Deferred

Published: 2026-10-11T07:17:24.493

Modified: 2026-10-13T20:36:00.850

Link: CVE-2026-81156

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T14:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')