CVE-2026-81154
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before…
- Risk score
- 45/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 11 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including adm…
- Affected
- See advisory
- Fix
- Upgrade the product to 5.2.6 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
Last activity 11 Oct 2026. Patch Forecast updates every hour.