Robo Gallery WordPress Plugin CVE-2026-81153

Requires an authenticated account with the Author role or higher on the target WordPress site; the attacker injects a stored XSS payload into one of Robo Gallery's image settings (the specific gallery image configuration fields that are output without sanitisation/escaping on the gallery page). The payload executes when any visitor - including an administrator - renders the affected gallery page. Notably, exploitation does NOT require the unfiltered_html capability, so the standard WordPress multisite hardening that strips unfiltered_html does NOT mitigate this issue. Limiting factors: exploitation is gated on possessing at least Author privileges (not anonymous), and the payload only fires when a victim actually views the gallery page containing the stored payload (user interaction required); sites with no untrusted Author-or-above accounts are at substantially lower practical risk.

This is a moderate-risk, authenticated stored XSS (CWE-79) in the Robo Gallery WordPress plugin, best treated as an elevated-priority patch for multi-author/multisite WordPress deployments rather than an emergency. The input CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) is internally inconsistent with the description and should be treated with caution: the description states exploitation requires only the Author role, which maps to PR:L (not PR:H), and a stored XSS that fires in an administrator's browser is a cross-context impact that normally warrants S:C with LOW C/I and no availability impact - the input's C:H/I:H/A:H and S:U overstate direct technical impact for an XSS. No EPSS score and no SSVC decision data were provided, so automatability and exploitation-likelihood signals cannot be compared. The vulnerability is NOT in CISA KEV (no active exploitation signal), but publicly available exploit code exists via the WPScan advisory, so the realistic threat is an insider or compromised low-privilege (Author) account escalating toward administrator takeover via admin-viewed stored payloads. Net: a real priority where untrusted Author-level users exist (especially multisite, since the flaw bypasses the unfiltered_html restriction), but lower urgency on single-admin sites where no untrusted Author accounts exist.

A user with Author-level access (self-registered on an open multi-author site, or a compromised author account) saves a malicious script payload into one of Robo Gallery's unsanitised image settings. When an administrator or any visitor later views the affected gallery page, the stored JavaScript executes in their browser, enabling session/cookie theft or admin-context actions such as creating a new admin user - and because the plugin does not rely on the unfiltered_html capability, this works even on multisite where that capability is normally stripped. A public proof-of-concept is documented in the WPScan advisory.