Stored Cross-Site Scripting Vulnerability in Robo Gallery Plugin for WordPress
CVE-2026-81156

Currently unrated

Key Information:

Vendor

WordPress
Status
Robo Gallery
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81156?

The Robo Gallery WordPress plugin prior to version 5.2.6 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from the plugin's failure to properly sanitize and escape certain gallery settings when displayed on the gallery edit screen. As a result, users with Contributor levels and higher can inject malicious JavaScript, which is then executed in the context of any administrator who edits the gallery. This could potentially lead to unauthorized access or manipulation of administrative functions.

Affected Version(s)

Robo Gallery 0 < 5.2.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81156 - Proof of Concept

References

https://wpscan.com/vulnerability/e8c9aabb-a889-473b-b107-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaswanth Reddy Sunkara
WPScan
.