Robo Gallery: Stored cross-site scripting
The supplied vector requires an authenticated attacker with low privileges; the exact WordPress role is not identified. Attacker-controlled content is stored and later rendered without sufficient neutralization, allowing script execution under the site origin when a victim views the affected output. The export does not identify the write endpoint, field, rendering function or victim role; an administrator session is exposed only if that user encounters the content. The vector reports low confidentiality impact, low integrity impact, low availability impact. Affected versions: <= 5.1.6. The authoritative export identifies 5.2.6 as fixed for this CVE.
- Component
- Robo Gallery
- Plugin slug
robo-gallery- Affected
- <= 5.1.6
- Safe version
5.2.6- Published
- Oct 08, 2026
This CVE was published Oct 08, 2026 and is one of 22 known issues for this plugin.
Update, patch or deactivate.
Update to 5.2.6 or a later supported release. Application-level remediation: Validate persisted content and apply context-appropriate escaping when rendering it. Enforce the intended write permissions and remove malicious stored values after updating.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through 5.1.6.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L