CVE-2026-4300 | THREATINT

Description

The Robo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Loading Label’ setting in all versions up to, and including, 5.1.3. The plugin uses a custom `|***…***|` marker pattern in its `fixJsFunction()` method to embed raw JavaScript function references within JSON-encoded configuration objects. When a gallery’s options are rendered on the frontend, `json_encode()` wraps all string values in double quotes. The `fixJsFunction()` method then strips the `”|***` and `***|”` sequences, effectively converting a JSON string value into raw JavaScript code. The Loading Label field (stored as `rbs_gallery_LoadingWord` post_meta) is an `rbstext` type field that is sanitized with `sanitize_text_field()` on save. While this strips HTML tags, it does not strip the `|***…***|` markers since they contain no HTML. When a user inputs `|***alert(document.domain)***|`, the value passes through sanitization intact, is stored in post_meta, and is later retrieved and output within an inline `

PUBLISHED Reserved 2026-03-16 | Published 2026-04-08 | Updated 2026-04-08 | Assigner Wordfence

MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Product status

Default status
unaffected

Any version
affected

Timeline

Credits

Athiwat Tiprasaharn finder

References

www.wordfence.com/…-693f-450a-89ef-e936a8813ca9?source=cve

plugins.trac.wordpress.org/…nd/modules/class/jsoptions.php

plugins.trac.wordpress.org/…nd/modules/class/jsoptions.php

plugins.trac.wordpress.org/…odules/base-grid/layout.v1.php

plugins.trac.wordpress.org/…odules/base-grid/layout.v1.php

plugins.trac.wordpress.org/…odules/base-grid/layout.v1.php

plugins.trac.wordpress.org/…odules/base-grid/layout.v1.php

plugins.trac.wordpress.org/…les/base-grid/grid/grid.v1.php

plugins.trac.wordpress.org/…les/base-grid/grid/grid.v1.php

plugins.trac.wordpress.org/…nd/modules/class/jsoptions.php

plugins.trac.wordpress.org/…nd/modules/class/jsoptions.php

plugins.trac.wordpress.org/…bs_gallery_options_loading.php

plugins.trac.wordpress.org/…bs_gallery_options_loading.php

plugins.trac.wordpress.org/…-gallery&sfp_email=&sfph_mail=

cve.org (CVE-2026-4300)

nvd.nist.gov (CVE-2026-4300)

Download JSON