CVE-2026-81156
Received Received - Intake

Stored Cross-Site Scripting in Robo Gallery WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-81156
EUVD
EUVD-2026-96750

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Robo Gallery 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Robo Gallery WordPress plugin. It occurs because the plugin does not properly sanitize or escape certain gallery settings before displaying them on the gallery edit screen. This allows users with Contributor role or higher to inject malicious JavaScript code that executes when an administrator opens the gallery for editing.

Detection Guidance

Check the installed version of the Robo Gallery WordPress plugin. If it is below 5.2.6, the system is vulnerable. You can verify this via the WordPress admin panel under Plugins or by checking the plugin files directly.

Impact Analysis

An attacker with Contributor access or higher could inject malicious scripts that run when an administrator views the gallery. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site. Administrators editing galleries may unknowingly execute harmful code.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR or HIPAA. If user data is exposed or modified due to the injected scripts, organizations could face legal penalties or reputational damage.

Mitigation Strategies

Update the Robo Gallery plugin to version 5.2.6 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart