Robo Gallery CVE-2026-81155

Exploitation requires an authenticated account with the Author role or higher on the target WordPress site, because the injection point is a Robo Gallery gallery setting that only such users can edit. The payload only fires when a visitor subsequently loads the frontend page displaying that gallery (the UI:R requirement), so execution depends on victim page views rather than being instant. Limiting factors: the attacker must already hold a semi-trusted content-creator account (not a public/anonymous attacker), the site must run Robo Gallery prior to version 5.2.6, and impact is realized only against users who view the poisoned gallery.

This is a moderate, not top-priority, vulnerability. The signals are mostly consistent: the provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R) describes a network-reachable but privilege- and interaction-gated flaw, which fits a stored XSS requiring an authenticated contributor-class account and a victim who later views the gallery page. A publicly available exploit exists (WPScan), raising the practical likelihood of use, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and should not be conflated. Two internal inconsistencies should be verified: (1) the input rates PR:H, yet the description says the 'Author role and above' is sufficient, and Author is a low-privilege role in WordPress, so PR:L is more defensible - the official rating may overstate the required privilege; (2) the C:H/I:H/A:H impact is unusually high for a reflected-in-DOM stored XSS and appears inflated - typical stored XSS confidentiality/integrity impact is Low with no availability impact. Net: a real but bounded issue requiring a semi-trusted insider account, best treated as standard-priority patching rather than emergency response.

An attacker who has obtained or been granted an Author-level (or higher) account on the WordPress site injects a malicious script into an unsanitised Robo Gallery gallery setting. When any visitor - including a logged-in administrator - views the affected gallery on the frontend, the script executes in their browser, enabling session/cookie theft or actions performed as that higher-privileged user. A public proof-of-concept is available from WPScan, lowering the effort to reproduce.