Robo Gallery EUVD-2026-96750

Exploitation requires an authenticated account with the Contributor role or higher on the target WordPress site, and the attacker must be able to create/save a Robo Gallery (before 5.2.6) with unsanitized gallery settings. The payload is inert until an administrator (or other higher-privileged user) opens the affected gallery on the edit screen - that user interaction is a hard prerequisite (UI:R), so no victim-side click means no execution. Limiting factors: sites that do not grant Contributor+ accounts to untrusted parties, or single-administrator installations where no lower-priv author exists, face little practical exposure; updating to 5.2.6 removes the flaw.

This is a moderate, authenticated-only stored XSS (CWE-79) affecting the Robo Gallery WordPress plugin before 5.2.6. The vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is internally inconsistent with the description: it specifies PR:H (high privileges) yet the description states the required attacker is a Contributor - a deliberately low-privilege role - so PR:L is more defensible; verify with vendor/WPScan. The high C:H/I:H/A:H impacts reflect the realistic outcome that JavaScript executing in an administrator's browser session can lead to full admin account/site takeover, but note scope is marked S:U despite the payload crossing from a low-priv author to an admin security authority, which arguably warrants S:C. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - this is not a drop-everything priority. However, publicly available exploit code exists (WPScan), which raises the practical likelihood of opportunistic use on sites that grant Contributor accounts to semi-trusted users. Net: a real but conditional risk - meaningful on multi-author sites, low on single-admin installations.

An attacker who holds (or registers for) a Contributor-level account on a WordPress site running Robo Gallery saves a gallery whose settings contain a malicious JavaScript payload that is not sanitized or escaped. When an administrator later opens that gallery on the edit screen, the stored script executes in the admin's authenticated browser session, enabling actions such as creating a rogue admin user or planting a backdoor. Publicly available exploit code (WPScan) lowers the barrier to reproduction.