CVE-2026-81153: CWE-79 Cross-Site Scripting (XSS) in Robo Gallery

CVE-2026-81153 is a stored Cross-Site Scripting vulnerability in the Robo Gallery WordPress plugin versions prior to 5.2.6. The vulnerability arises because the plugin does not sanitise and escape some image settings before outputting them in gallery pages. This allows users with the Author role or above to inject malicious scripts that execute in the context of any visitor viewing the gallery page, including administrators. The vulnerability is notable because it bypasses restrictions on unfiltered_html capability, affecting multisite WordPress installations as well.

Successful exploitation enables an attacker with Author or higher privileges to execute arbitrary JavaScript in the browsers of any user viewing the gallery page, including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions performed in the context of the victim's browser. The vulnerability affects multisite WordPress environments even when unfiltered_html is disabled, increasing its impact scope.

A fixed version of the Robo Gallery plugin is available at version 5.2.6. Users should upgrade to version 5.2.6 or later to remediate this vulnerability. No other mitigation or workaround is indicated. Patch status is confirmed by the versioning information indicating the fix in 5.2.6.