What is the CVSS score of CVE-2026-32356?

CVE-2026-32356 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Robo Gallery are affected by CVE-2026-32356?

CVE-2026-32356 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2026-32356?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Robo Gallery CVE-2026-32356

EUVD-2026-11846 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 Patchstack

WordPress XSS Robo Gallery Wordpress Plugin Robosoft

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11846

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.This issue affects Robo Gallery: from n/a through <= 5.1.2.

AnalysisAI

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in robosoft Robo Gallery through version 5.1.2, allowing authenticated attackers to inject malicious scripts into web pages generated by the application. An attacker with login credentials can craft malicious input that executes arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), which moderates but does not eliminate the threat.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a DOM-based XSS variant where user-supplied input is directly incorporated into the Document Object Model without proper sanitization or encoding. Robo Gallery is a WordPress gallery plugin component developed by robosoft that dynamically generates HTML content client-side. The root cause stems from insufficient input validation and output encoding when processing user-controlled parameters in DOM manipulation functions, allowing attackers to bypass client-side protections by injecting HTML/JavaScript payloads. The DOM-based nature means the vulnerability exists entirely in client-side JavaScript execution, making it difficult to detect via network-based security controls.

RemediationAI

Upgrade robosoft Robo Gallery to a patched version beyond 5.1.2 as soon as a security update becomes available through the WordPress plugin repository or the vendor's official advisory. Until a patch is deployed, implement the following mitigations: restrict gallery plugin functionality to trusted authenticated users only via role-based access controls, disable or remove the Robo Gallery plugin if it is not actively required, implement a Web Application Firewall (WAF) with DOM-XSS detection rules to block known payload patterns, and apply Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution. Monitor plugin changelogs and the vendor's security notifications for patch announcements.