Robo Gallery CVE-2026-81154

Exploitation requires an authenticated WordPress account at the Author role or above on a site running Robo Gallery before 5.2.6, the ability to set image alt text on gallery images, and use of the specific gallery layout that outputs alt text without sanitization/escaping. The payload is stored and only fires when a victim (e.g., an administrator or other visitor) views that affected gallery, so victim interaction is required (UI:R). Limiting factors: the attacker must already hold a privileged content-author account (not anonymous access), the vulnerable rendering is tied to one particular gallery layout, and a separate user must view the gallery for the script to execute - all of which constrain real-world exploitability despite network reachability.

This is a moderate-severity, authentication-gated stored XSS (CWE-79) in the Robo Gallery WordPress plugin. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) signals network reachability with low complexity but requires privileges and victim interaction. A key signal conflict exists: the vector encodes PR:H (high privilege), yet the description states exploitation is possible by 'users with the Author role and above' - Author is a mid-tier contributor role, not administrator, so PR:L is the more defensible reading; verify with WPScan. The C:H/I:H/A:H impact ratings also appear aggressive for a client-side XSS that executes in a victim's browser rather than compromising the server directly. No EPSS or SSVC data was provided, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Publicly available exploit code exists (WPScan), which raises the practical likelihood of opportunistic abuse on multi-author sites, but POC availability is distinct from confirmed in-the-wild exploitation. Net assessment: a real but second-tier priority - it depends on an attacker already holding an Author+ account, which meaningfully limits widespread, unauthenticated mass exploitation; it is most relevant to sites with untrusted or numerous content contributors.

An attacker with an Author-level (or higher) account on a WordPress site running Robo Gallery before 5.2.6 injects a malicious script payload into an image's alt text field. When an administrator or other user later views a gallery rendered in the vulnerable layout, the unsanitized alt text executes JavaScript in their browser, enabling session hijacking or admin-context actions. Publicly available exploit code (WPScan) lowers the skill barrier, though exploitation still requires a pre-existing authenticated account and a victim viewing the gallery.