The Robo Gallery plugin for WordPress versions up to 5.1.3 contains a stored cross-site scripting vulnerability (CWE-79) via the 'Loading Label' setting. This setting is sanitized using sanitize_text_field(), which removes HTML tags but does not remove the custom marker pattern '|***...***|'. The plugin uses a fixJsFunction() method that strips these markers from JSON-encoded strings to embed raw JavaScript code. An attacker with Author-level privileges can inject JavaScript code wrapped in these markers, which is stored in post_meta and later output in an inline script block with the markers removed, resulting in arbitrary JavaScript execution in users' browsers. The vulnerability requires authenticated access at the Author level or higher and does not require user interaction beyond page load. The CVSS 3.1 score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and privileges required at the Author level.

An authenticated attacker with Author-level permissions can inject arbitrary JavaScript code into pages containing the vulnerable gallery shortcode. This can lead to execution of malicious scripts in the context of users visiting those pages, potentially compromising confidentiality and integrity of user sessions or data accessible via the browser. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user permissions to trusted users only and consider removing or disabling the Robo Gallery plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.