CVE-2026-81153 — Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author …
Published: 2026-10-11 · CVSS: 6.8 · CVSS 3.1
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7