WP-Safety

Robo Gallery – Photo & Image Slider Security & Risk Analysis

wordpress.org/plugins/robo-gallery

Robo Gallery is a powerful image gallery and photo gallery plugin with advanced features to create responsive galleries with a beautiful lightbox

40K active installs v5.1.4 PHP + WP 3.3+ Updated Mar 22, 2026
galleryimage-galleryphoto-galleryresponsive-gallerywordpress-gallery-plugin
83
B · Generally Safe
CVEs total19
Unpatched0
Last CVEApr 7, 2026
Plugin page Download
Safety Verdict

Is Robo Gallery – Photo & Image Slider Safe to Use in 2026?

Mostly Safe

Score 83/100

Robo Gallery – Photo & Image Slider is generally safe to use. 19 past CVEs were resolved.

19 known CVEsLast CVE: Apr 7, 2026Updated 1mo ago
Risk Assessment

The robo-gallery plugin version 5.1.2 - 54264 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query preparation (93%) and a significant number of capability checks (23), it also presents notable weaknesses. The presence of 5 unprotected entry points, specifically 4 AJAX handlers and 1 REST API route without permission callbacks, creates a significant attack surface. Furthermore, the use of dangerous functions like `unserialize` without apparent sanitization of its input is a critical concern that could lead to severe vulnerabilities. The plugin's vulnerability history is particularly alarming, with 17 known CVEs, including 1 critical, 2 high, and 14 medium severity vulnerabilities. Common themes in past vulnerabilities include missing authorization, CSRF, information exposure, XSS, and code injection, all of which are serious threats.

While the current static analysis does not report critical or high severity taint flows and there are no currently unpatched CVEs, the historical pattern of critical and high severity vulnerabilities, coupled with the static analysis findings of unprotected entry points and the potential for deserialization vulnerabilities, suggests a high inherent risk. The low percentage of properly escaped output (29%) also raises concerns about potential cross-site scripting vulnerabilities. The plugin's past indicates a recurring struggle with secure coding practices, and the current analysis reveals several critical areas that require immediate attention to mitigate potential exploitation.

Key Concerns

  • 4 AJAX handlers without auth checks
  • 1 REST API route without permission callbacks
  • 2 dangerous functions (unserialize)
  • 29% properly escaped output
  • 1 critical CVE in history
  • 2 high CVEs in history
  • 14 medium CVEs in history
  • Recurring vulnerability types (Auth, CSRF, XSS, Code Injection)
Vulnerabilities
19 published

Robo Gallery – Photo & Image Slider Security Vulnerabilities

CVEs by Year

1 CVE in 2016
2016
1 CVE in 2022
2022
4 CVEs in 2023
2023
8 CVEs in 2024
2024
3 CVEs in 2025
2025
2 CVEs in 2026
2026
Patched Has unpatched

Severity Breakdown

Critical
1
High
2
Medium
16

19 total CVEs

CVE-2026-4300medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting

Apr 7, 2026 Patched in 5.1.4 (1d)
CVE-2026-32356medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Feb 14, 2026 Patched in 5.1.3 (61d)
CVE-2025-47521medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

May 7, 2025 Patched in 5.0.3 (7d)
CVE-2024-10144medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

Mar 11, 2025 Patched in 3.2.22 (36d)
CVE-2024-13384medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.23 - Authenticated (Admin+) Stored Cross-Site Scripting

Mar 3, 2025 Patched in 3.2.24 (88d)
CVE-2024-10102medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

Dec 17, 2024 Patched in 3.2.22 (32d)
CVE-2024-49696medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 3.2.21 - Authenticated (Author+) Stored Cross-Site Scripting

Oct 21, 2024 Patched in 3.2.22 (10d)
CVE-2024-8431medium · 4.3Missing Authorization

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure

Oct 7, 2024 Patched in 3.2.22 (1d)
CVE-2024-3896medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Title

Jul 24, 2024 Patched in 3.2.20 (1d)
CVE-2024-3894medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title

Jun 18, 2024 Patched in 3.2.20 (1d)
CVE-2024-5343high · 8.8Cross-Site Request Forgery (CSRF)

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss

Jun 18, 2024 Patched in 3.2.20 (1d)
CVE-2024-34382medium · 5.3Exposure of Sensitive Information to an Unauthorized Actor

Robo Gallery <= 3.2.18 - Unauthenticated Information Exposure

May 3, 2024 Patched in 3.2.19 (5d)
CVE-2024-22295medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 3.2.17 - Authenticated (Author+) Stored Cross-Site Scripting

Jan 17, 2024 Patched in 3.2.18 (8d)
CVE-2023-3499medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 3.2.15 - Authenticated(Administrator+) Stored Cross-Site Scripting

Aug 15, 2023 Patched in 3.2.16 (161d)
CVE-2023-27620medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Robo Gallery <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

Mar 13, 2023 Patched in 3.2.13 (316d)
CVE-2022-45804medium · 4.3Cross-Site Request Forgery (CSRF)

Robo Gallery <= 3.2.9 - Cross-Site Request Forgery via getPluginStatus

Feb 2, 2023 Patched in 3.2.11 (355d)
CVE-2023-24414medium · 4.3Cross-Site Request Forgery (CSRF)

Robo Gallery Plugin <= 3.2.11 - Cross-Site Request Forgery

Jan 30, 2023 Patched in 3.2.12 (358d)
CVE-2022-45841high · 8.1Missing Authorization

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.9 - Missing Authorization

Dec 12, 2022 Patched in 3.2.11 (407d)
WF-abdd6aaa-830e-4a79-acfb-93dc4a26f599-robo-gallerycritical · 9.8Improper Control of Generation of Code ('Code Injection')

Photo Gallery, Images, Slider in Rbs Image Gallery <= 2.0.14 - Remote Code Execution

Apr 12, 2016 Patched in 2.0.15 (2842d)
Version History

Robo Gallery – Photo & Image Slider Release Timeline

v5.1.4Current
v5.1.31 CVE
CVE-2026-4300
v5.1.22 CVEs
CVE-2026-32356 CVE-2026-4300
v5.1.12 CVEs
CVE-2026-32356 CVE-2026-4300
v5.1.02 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.92 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.72 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.62 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.52 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.42 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.32 CVEs
CVE-2026-32356 CVE-2026-4300
v5.0.23 CVEs
CVE-2026-32356 CVE-2025-47521 CVE-2026-4300
v5.0.13 CVEs
CVE-2026-32356 CVE-2025-47521 CVE-2026-4300
v5.0.03 CVEs
CVE-2026-32356 CVE-2025-47521 CVE-2026-4300
v3.2.243 CVEs
CVE-2026-32356 CVE-2025-47521 CVE-2026-4300
v3.2.234 CVEs
CVE-2026-32356 CVE-2025-47521 CVE-2024-13384 +1 more
v3.2.224 CVEs
CVE-2026-32356 CVE-2025-47521 CVE-2024-13384 +1 more
v3.2.218 CVEs
CVE-2026-32356 CVE-2024-10102 CVE-2024-8431 +5 more
v3.2.208 CVEs
CVE-2026-32356 CVE-2024-10102 CVE-2024-8431 +5 more
v3.2.1911 CVEs
CVE-2024-5343 CVE-2026-32356 CVE-2024-10102 +8 more
Code Analysis
Analyzed Mar 16, 2026

Robo Gallery – Photo & Image Slider Code Analysis

Dangerous Functions
2
Raw SQL Queries
1
14 prepared
Unescaped Output
507
207 escaped
Nonce Checks
9
Capability Checks
23
File Operations
2
External Requests
1
Bundled Libraries
0

Dangerous Functions Found

unserialize$fieldValue = is_serialized($fieldValue) ? unserialize($fieldValue) : $fieldValue;app\extensions\fields\include\roboGalleryFieldsMetaBoxClass.php:200
unserialize$datetime = unserialize( $args['value'] );cmbre2\includes\CMBRE2_Types.php:578

SQL Query Safety

93% prepared15 total queries

Output Escaping

29% escaped714 total outputs
Data Flows · Security
8 unsanitized

Data Flow Analysis

13 flows8 with unsanitized paths
get_images_tags_from_ids (app\extensions\fields\include\roboGalleryFieldsAjax.php:119)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
5 unprotected

Robo Gallery – Photo & Image Slider Attack Surface

Entry Points7
Unprotected5

AJAX Handlers 4

authwp_ajax_rb_check_statusapp\extensions\manager\class.addons.php:68
authwp_ajax_rb_activate_included_pluginapp\extensions\manager\class.addons.php:71
authwp_ajax_rb_deactivate_included_pluginapp\extensions\manager\class.addons.php:74
authwp_ajax_robo_gallery_get_gallery_jsonincludes\extensions\block\src\init.php:25

REST API Routes 2

GET/wp-json/robogallery/v1/images/app\extensions\fields\include\roboGalleryFieldsAjax.php:31
GET/wp-json/robogallery/v1/images/(?P<ids>[0-9,]+)app\extensions\fields\include\roboGalleryFieldsAjax.php:37

Shortcodes 1

[robo-gallery] includes\frontend\rbs_gallery_frontend.php:34
WordPress Hooks 113
actioninitapp\class.listing.php:33
actionin_admin_headerapp\class.listing.php:43
actioninitapp\class.php:21
actiontemplate_redirectapp\extensions\access\AccessMode.php:79
actioninitapp\extensions\access\AccessMode.php:89
filterpost_type_linkapp\extensions\access\AccessMode.php:99
filterupdate_post_metadataapp\extensions\access\AccessMode.php:109
filterpre_get_postsapp\extensions\access\FilterPrivateGallery.php:41
filterwp_sitemaps_posts_query_argsapp\extensions\access\FilterPrivateGallery.php:44
filterwp_sitemaps_posts_pre_url_listapp\extensions\access\FilterPrivateGallery.php:47
actionadmin_menuapp\extensions\dashboard\class.dashboard.php:92
actioninitapp\extensions\dashboard\class.dashboard.php:193
filterpost_row_actionsapp\extensions\duplicate\class.duplicate.php:21
filterpage_row_actionsapp\extensions\duplicate\class.duplicate.php:22
actionadmin_action_roboGalleryDuplicate_saveNewPostapp\extensions\duplicate\class.duplicate.php:24
actionadmin_action_roboGalleryDuplicate_saveNewPostDraftapp\extensions\duplicate\class.duplicate.php:25
actionrobo_gallery_clone_galleryapp\extensions\duplicate\class.duplicate.php:27
actionadmin_noticesapp\extensions\duplicate\class.duplicate.php:31
actioninitapp\extensions\fields\include\roboGalleryFields.php:30
actioninitapp\extensions\fields\include\roboGalleryFields.php:31
actionadmin_enqueue_scriptsapp\extensions\fields\include\roboGalleryFields.php:32
filteradmin_body_classapp\extensions\fields\include\roboGalleryFields.php:33
actionrest_api_initapp\extensions\fields\include\roboGalleryFieldsAjax.php:30
actionadd_meta_boxesapp\extensions\fields\include\roboGalleryFieldsMetaBoxClass.php:67
actionuser_registerapp\extensions\fields\include\roboGalleryFieldsMetaBoxClass.php:68
actionsave_postapp\extensions\fields\include\roboGalleryFieldsMetaBoxClass.php:69
actionwp_loadedapp\extensions\galleryType\changeGalleryType.php:46
actionadmin_noticesapp\extensions\galleryType\changeGalleryType.php:47
actionin_admin_headerapp\extensions\galleryType\init.php:68
actionin_admin_headerapp\extensions\galleryType\init.php:69
actionadmin_menuapp\extensions\galleryType\init.php:71
actionadmin_bar_menuapp\extensions\galleryType\init.php:72
filteradmin_body_classapp\extensions\galleryType\init.php:85
filterpost_updated_messagesapp\extensions\galleryType\init.php:86
filtermanage_posts_columnsapp\extensions\galleryType\init.php:95
actionin_admin_headerapp\extensions\galleryType\init.php:96
filtercmbre2_rbs_args_defaultvalueapp\extensions\galleryType\initThemeOptions.php:53
actioninitapp\extensions\language\class.language.php:14
actioninitapp\extensions\manager\class.addons.php:63
actionadmin_menuapp\extensions\manager\class.addons.php:110
actionrest_api_initapp\extensions\restapi\class.restapi.php:25
actionrest_api_initapp\extensions\restapi\class.restapi.php:26
filtercmbre2_render_bordercmbre2\fields\border\cmb-field-border.php:101
filtercmbre2_render_columscmbre2\fields\colums\cmb-field-colums.php:219
filtercmbre2_render_fontcmbre2\fields\font\cmb-field-font.php:276
filtercmbre2_render_hidden_arraycmbre2\fields\hidden_array\init.php:40
filtercmbre2_render_loadingcmbre2\fields\loading\cmb-field-loading.php:100
filtercmbre2_sanitize_loadingcmbre2\fields\loading\cmb-field-loading.php:114
filtercmbre2_types_esc_loadingcmbre2\fields\loading\cmb-field-loading.php:128
filtercmbre2_render_multisizecmbre2\fields\multisize\rbs-multiSize.php:73
filtercmbre2_render_paddingcmbre2\fields\padding\rbs-padding.php:120
filtercmbre2_render_rbsgallerycmbre2\fields\rbsgallery\cmb-field-rbsgallery.php:85
filtercmbre2_render_rbsradiobuttoncmbre2\fields\rbsradiobutton\rbs-radiobutton.php:75
filtercmbre2_render_rbsselectcmbre2\fields\rbsselect\cmb-field-rbsselect.php:61
filtercmbre2_render_rbstextcmbre2\fields\rbstext\cmb-field-rbstext.php:48
filtercmbre2_render_rbstextareacmbre2\fields\rbstextarea\cmb-field-rbstextarea.php:44
filtercmbre2_render_shadowcmbre2\fields\shadow\cmb-field-shadow.php:106
filtercmbre2_render_sizecmbre2\fields\size\cmb-field-size.php:120
filtercmbre2_render_slidercmbre2\fields\slider\cmb-field-slider.php:51
filtercmbre2_render_switchcmbre2\fields\switch\cmb-field-switch.php:72
actionadmin_enqueue_scriptscmbre2\fields\toolbox\cmb-field-toolbox.php:19
actionin_admin_headercmbre2\fields\toolbox\cmb-field-toolbox.php:22
filterget_post_metadatacmbre2\includes\CMBRE2_Ajax.php:115
filterupdate_post_metadatacmbre2\includes\CMBRE2_Ajax.php:118
filtercmbre2_show_oncmbre2\includes\CMBRE2_hookup.php:60
actionadd_meta_boxescmbre2\includes\CMBRE2_hookup.php:77
actionadd_attachmentcmbre2\includes\CMBRE2_hookup.php:78
actionedit_attachmentcmbre2\includes\CMBRE2_hookup.php:79
actionsave_postcmbre2\includes\CMBRE2_hookup.php:80
actionshow_user_profilecmbre2\includes\CMBRE2_hookup.php:109
actionedit_user_profilecmbre2\includes\CMBRE2_hookup.php:110
actionuser_new_formcmbre2\includes\CMBRE2_hookup.php:111
actionpersonal_options_updatecmbre2\includes\CMBRE2_hookup.php:113
actionedit_user_profile_updatecmbre2\includes\CMBRE2_hookup.php:114
actionuser_registercmbre2\includes\CMBRE2_hookup.php:115
actioninitcmbre2\init.php:80
actionsave_postincludes\cache.php:23
actionwp_insert_postincludes\cache.php:36
actionenqueue_block_assetsincludes\extensions\block\src\init.php:19
actionenqueue_block_editor_assetsincludes\extensions\block\src\init.php:21
actioninitincludes\extensions\block\src\init.php:23
filterblock_categories_allincludes\extensions\block\src\init.php:27
actionadd_meta_boxesincludes\extensions\category\category.class.php:33
actionadmin_enqueue_scriptsincludes\extensions\category\category.class.php:36
actiondo_meta_boxesincludes\extensions\category\category.class.php:42
actioninitincludes\extensions\category\category.init.php:19
actionadmin_footerincludes\extensions\stats\stats.class.php:25
actioninitincludes\extensions\stats\stats.init.php:20
actionadmin_menuincludes\extensions\stats\stats.init.php:24
filterremovable_query_argsincludes\extensions\stats\stats.init.php:33
actionclear_db_cache_hookincludes\frontend\modules\class\cachedb.php:63
filterthe_contentincludes\frontend\rbs_gallery_frontend.php:21
actionmedia_buttonsincludes\rbs_gallery_button.php:50
actioncmbre2_initincludes\rbs_gallery_edit.php:77
actionplugins_loadedincludes\rbs_gallery_init.php:30
actionwp_loadedincludes\rbs_gallery_init.php:156
actioninitincludes\rbs_gallery_init.php:159
actionadmin_initincludes\rbs_gallery_init.php:185
actionplugins_loadedincludes\rbs_gallery_init.php:266
actionadmin_headincludes\rbs_gallery_media.php:33
filterattachment_fields_to_editincludes\rbs_gallery_media.php:139
filterattachment_fields_to_saveincludes\rbs_gallery_media.php:166
actioninitincludes\rbs_gallery_menu.php:36
actionadmin_menuincludes\rbs_gallery_menu.php:40
actionadmin_menuincludes\rbs_gallery_menu.php:50
actionadmin_menuincludes\rbs_gallery_menu.php:62
actionadmin_menuincludes\rbs_gallery_menu.php:69
actionin_admin_headerincludes\rbs_gallery_menu.php:104
actionadmin_initincludes\rbs_gallery_settings.php:32
actionadmin_menuincludes\rbs_gallery_settings.php:33
actionwidgets_initincludes\rbs_gallery_widget.php:197
actionwidgets_initincludes\rbs_gallery_widget_last.php:99
filterthe_titleincludes\rbs_hooks.php:22
Maintenance & Trust

Robo Gallery – Photo & Image Slider Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 22, 2026
PHP min version
Downloads2.4M

Community Trust

Rating86/100
Number of ratings403
Active installs40K
Alternatives

Robo Gallery – Photo & Image Slider Alternatives

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

photo-gallery

B
75

Photo Gallery is a powerful image gallery plugin with a list of advanced options for creating responsive image galleries with beautiful lightbox.

200K 62 CVEs
Photo Gallery by Ays – Responsive Image Gallery

Photo Gallery by Ays – Responsive Image Gallery

gallery-photo-gallery

A
86

Photo Gallery is a cool responsive image gallery plugin with beautiful views

2K 10 CVEs
Photo gallery lightbox – 📱 mobile friendly gallery plugin –– Story Show Gallery

Photo gallery lightbox – 📱 mobile friendly gallery plugin –– Story Show Gallery

story-show-gallery

A
100

Full screen photo gallery lightbox for delightful display of your photos, with a lot of features, fully customizable, free.

200 No CVEs
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

nextgen-gallery

B
76

The most popular gallery plugin that lets you create galleries and albums in seconds.

400K 38 CVEs
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

envira-gallery-lite

A
95

Envira Gallery is a fast, easy and powerful gallery builder with lightbox, masonry and grid layouts, albums, videos, and responsive displays and more

100K 11 CVEs
Developer Profile

Robo Gallery – Photo & Image Slider Developer Profile

robosoft

1 plugin · 40K total installs

67
trust score
Avg Security Score
83/100
Avg Patch Time
247 days
View full developer profile
Detection Fingerprints

How We Detect Robo Gallery – Photo & Image Slider

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/robo-gallery/css/admin/list.css/wp-content/plugins/robo-gallery/js/admin/listing.js/wp-content/plugins/robo-gallery/js/admin/info.js/wp-content/plugins/robo-gallery/css/admin/info.css
Script Paths
/wp-content/plugins/robo-gallery/js/admin/listing.js/wp-content/plugins/robo-gallery/js/admin/info.js
Version Parameters
robo-gallery/css/admin/list.css?ver=robo-gallery/js/admin/listing.js?ver=robo-gallery/js/admin/info.js?ver=robo-gallery/css/admin/info.css?ver=

HTML / DOM Fingerprints

CSS Classes
robo-gallery-shortcode
Data Attributes
data-opendata-titledata-closedata-info
Shortcode Output
[robo-gallery id=
FAQ

Frequently Asked Questions about Robo Gallery – Photo & Image Slider