Skip to content
Sign in
6.8 Medium

CVE-2026-81153 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before…

Description

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.

Affected products and versions

Product Affected versions Fixed in
Robo Gallery 5.2 earliest → < 5.2.6 5.2.6

Other CVEs of Robo Gallery

The 4 CVEs of Robo Gallery →
CVE-2026-81156 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before… 6.8 Medium CVE-2026-81155 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a… 6.8 Medium CVE-2026-81154 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in… 6.8 Medium
Track this CVE