Robo Gallery EUVD-2026-94945

Exploitation requires an authenticated low-privilege WordPress account (e.g., contributor or author) capable of submitting Robo Gallery content, since the plugin stores attacker-supplied input without proper neutralization (CWE-79). The stored payload only executes when another user - typically an administrator - subsequently views the page rendering the affected gallery (UI:R). Limiting factors: the need for a valid posting account (PR:L), the requirement that a victim actually load the injected page, and applicability only to Robo Gallery versions through 5.1.6; sites that do not allow untrusted users to register or post are not realistically exposed.

This is a moderate-severity Stored XSS (CWE-79) in the Robo Gallery WordPress plugin, rated CVSS 6.5 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network vector and low attack complexity make it easy to reach, but two factors meaningfully constrain real-world risk: PR:L means an attacker must already hold an authenticated low-privilege account (e.g., contributor/author) to plant the payload, and UI:R means a victim must view the affected page for the stored script to fire. The scope change (S:C) is the signal that elevates this - the injected script executes in the browser context of other users, typically an administrator, enabling session/account takeover beyond the vulnerable component. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability data is absent, not low. This is a credible but not emergency priority: it is a classic Patchstack-catalogued authenticated stored XSS, the kind that is realistic only where untrusted users can obtain posting accounts. Treat it as a standard patch-cycle item rather than a drop-everything issue, prioritizing sites with open or multi-author registration.

An attacker with a low-privilege authenticated account (such as contributor or author) on a WordPress site running Robo Gallery ≤5.1.6 submits a gallery or related input containing a malicious script payload that is stored unsanitized. When an administrator or other user later views the page rendering that gallery content, the script executes in their browser, potentially hijacking their session or performing actions on their behalf. No public exploit code was identified in the provided data, but the low attack complexity makes crafting a payload straightforward.