CVE-2026-81155: Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label

Q: Who can exploit this issue, and who is affected by the payload?

A user with the WordPress Author role or any higher-privileged role can store a malicious script through a gallery setting. The script executes for any visitor who views the affected gallery, including administrators.

Q: Which gallery setting is involved?

The affected setting is the gallery search label. In versions before 5.2.6, its value is not sanitised and escaped before being output on a frontend page.

Q: Are sites running version 5.2.6 affected?

The issue affects Robo Gallery versions before 5.2.6. The provided information does not identify any affected versions at or after 5.2.6.

Published Oct 11, 2026

Updated

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.

Affected Software

1 affected component

robosoft Robo Gallery<5.2.6

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue, and who is affected by the payload?

A user with the WordPress Author role or any higher-privileged role can store a malicious script through a gallery setting. The script executes for any visitor who views the affected gallery, including administrators.

Which gallery setting is involved?

The affected setting is the gallery search label. In versions before 5.2.6, its value is not sanitised and escaped before being output on a frontend page.

Are sites running version 5.2.6 affected?

The issue affects Robo Gallery versions before 5.2.6. The provided information does not identify any affected versions at or after 5.2.6.

CVE-2026-81155: Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is affected by the payload?

Which gallery setting is involved?

Are sites running version 5.2.6 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is affected by the payload?

Which gallery setting is involved?

Are sites running version 5.2.6 affected?