CVE-2026-81156mediumCWE-79

CVE-2026-81156: medium-severity vulnerability in Robo Gallery

Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings

Published

Follow this CVE+ Monitor Robo Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.3%
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Robo Gallery
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Robo Gallery

In the same product, most dangerous first.

CVE-2026-81155MEDIUMRobo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search LabelEPSS 0.3%CVE-2026-81154MEDIUMRobo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt TextEPSS 0.3%CVE-2026-81153MEDIUMRobo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect MetaEPSS 0.3%