CVE-2026-81153: Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta

Q: Who can exploit this issue?

A user with the WordPress Author role or a higher-privileged role can exploit it by supplying malicious content through affected image overlay effect settings.

Q: Are WordPress multisite sites protected if unfiltered_html is disabled?

No. The issue can be exploited even when the unfiltered_html capability is disallowed, including in WordPress multisite deployments.

Q: Who is exposed to the injected script?

Any visitor who views a gallery containing the malicious settings may execute the stored script in their browser. This includes site administrators.

Q: What versions are affected?

Robo Gallery versions before 5.2.6 are affected. Updating to version 5.2.6 or later addresses the affected version range.

Published Oct 11, 2026

Updated

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfilteredhtml capability is disallowed such as on multisite.

Affected Software

1 affected component

robosoft Robo Gallery<5.2.6

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress Author role or a higher-privileged role can exploit it by supplying malicious content through affected image overlay effect settings.

Are WordPress multisite sites protected if unfiltered_html is disabled?

No. The issue can be exploited even when the unfiltered_html capability is disallowed, including in WordPress multisite deployments.

Who is exposed to the injected script?

Any visitor who views a gallery containing the malicious settings may execute the stored script in their browser. This includes site administrators.

What versions are affected?

Robo Gallery versions before 5.2.6 are affected. Updating to version 5.2.6 or later addresses the affected version range.

CVE-2026-81153: Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are WordPress multisite sites protected if unfiltered_html is disabled?

Who is exposed to the injected script?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are WordPress multisite sites protected if unfiltered_html is disabled?

Who is exposed to the injected script?

What versions are affected?