What is GHSA-hhc5-3q59-7gxq?

GHSA-hhc5-3q59-7gxq is a security advisory published by GitHub Security Advisories with Medium severity. The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image...

Which CVE IDs does GHSA-hhc5-3q59-7gxq cover?

GHSA-hhc5-3q59-7gxq covers the following CVE IDs: CVE-2026-81153. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hhc5-3q59-7gxq?

GHSA-hhc5-3q59-7gxq has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-hhc5-3q59-7gxqMediumCVSS 6.8

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image...

Vendor

GitHub Security Advisories

Published

October 11, 2026

Last Modified

October 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-81153 →

📋 Description

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-81153
https://wpscan.com/vulnerability/3bf12831-e386-4a69-857b-3dda05ee0bce
https://github.com/advisories/GHSA-hhc5-3q59-7gxq