CVE-2026-4300 Robo Gallery CVE debrief

Who should care

Users of the Robo Gallery plugin for WordPress, particularly those with Author-level access and above, should be aware of this vulnerability and take steps to protect their sites by updating the plugin to the latest version, limiting Author-level access to trusted users, and monitoring for suspicious activity on the site.

Technical summary

The Robo Gallery plugin uses a custom `|***...***|` marker pattern in its `fixJsFunction()` method to embed raw JavaScript function references within JSON-encoded configuration objects. When a gallery's options are rendered on the frontend, `json_encode()` wraps all string values in double quotes. The `fixJsFunction()` method then strips the `|***` and `***|` sequences, effectively converting a JSON string value into raw JavaScript code. The Loading Label field (stored as `rbs_gallery_LoadingWord` post_meta) is an `rbstext` type field that is sanitized with `sanitize_text_field()` on save. While this strips HTML tags, it does not strip the `|***...***|` markers since they contain no HTML.

Defensive priority

Medium

Recommended defensive actions

• Update the Robo Gallery plugin to the latest version
• Limit Author-level access and above to trusted users
• Monitor for suspicious activity on the site
• Use a Web Application Firewall (WAF) to detect and prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T10:16:01.953Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Deferred. The Robo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting in all versions up to, and including, 5.1.3. This vulnerability allows authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the gallery shortcode. Evidence limits suggest that defenders verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources