CVE-2026-4300 Robo Gallery CVE debrief

Who should care

Users of the Robo Gallery plugin for WordPress, particularly those with Author-level access and above, should be aware of this vulnerability and take steps to protect their sites by updating the plugin to the latest version, limiting Author-level access to trusted users, and monitoring for suspicious activity on the site.

Technical summary

The Robo Gallery plugin uses a custom `|***...***|` marker pattern in its `fixJsFunction()` method to embed raw JavaScript function references within JSON-encoded configuration objects. When a gallery's options are rendered on the frontend, `json_encode()` wraps all string values in double quotes. The `fixJsFunction()` method then strips the `|***` and `***|` sequences, effectively converting a JSON string value into raw JavaScript code. The Loading Label field (stored as `rbs_gallery_LoadingWord` post_meta) is an `rbstext` type field that is sanitized with `sanitize_text_field()` on save. While this strips HTML tags, it does not strip the `|***...***|` markers since they contain no HTML.

Defensive priority

Medium

Recommended defensive actions

• Update the Robo Gallery plugin to the latest version
• Limit Author-level access and above to trusted users
• Monitor for suspicious activity on the site
• Use a Web Application Firewall (WAF) to detect and prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T10:16:01.953Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Deferred. The Robo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting in all versions up to, and including, 5.1.3. This vulnerability allows authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the gallery shortcode. Evidence limits suggest that defenders verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.