CVE-2026-81154mediumCWE-79

CVE-2026-81154: medium-severity vulnerability in Robo Gallery

Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text

Published

Follow this CVE+ Monitor Robo Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.3%
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Robo Gallery
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Robo Gallery

In the same product, most dangerous first.

CVE-2026-81156MEDIUMRobo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery SettingsEPSS 0.3%CVE-2026-81155MEDIUMRobo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search LabelEPSS 0.3%CVE-2026-81153MEDIUMRobo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect MetaEPSS 0.3%