CVE-2023-3499

🗓️ 04 Sep 2023 11:27:01Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 39 Views🌐 WEB

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 allows Stored Cross-Site Scripting attack

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin Photo Gallery, Images, Slider in Rbs Image Gallery Cross Site Scripting Vulnerability	4 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-3499 Robo Gallery < 3.2.16 - Admin+ Stored XSS	4 Sep 202311:27	–	cvelist
EUVD	EUVD-2023-44158	3 Oct 202520:07	–	euvd
NVD	CVE-2023-3499	4 Sep 202312:15	–	nvd
OSV	CVE-2023-3499	4 Sep 202312:15	–	osv
Prion	Cross site scripting	4 Sep 202312:15	–	prion
Positive Technologies	PT-2023-25083 · WordPress · Rbs Image Gallery	4 Sep 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-3499	23 May 202503:57	–	redhatcve
Vulnrichment	CVE-2023-3499 Robo Gallery < 3.2.16 - Admin+ Stored XSS	4 Sep 202311:27	–	vulnrichment
wpexploit	Robo Gallery < 3.2.16 - Admin+ Stored XSS	14 Aug 202300:00	–	wpexploit

NVD

Vulners

Node

robogallery robo_galleryRange<3.2.16wordpress

[
  {
    "vendor": "Unknown",
    "product": "Photo Gallery, Images, Slider in Rbs Image Gallery",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.2.16"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/ea29413b-494e-410e-ae42-42f96284899c

Parameter	Position	Path	Description	CWE
Youtube Api Key	request body	/wp-admin/edit.php?post_type=robo_gallery_table&page=robo-gallery-settings&tab=youtube	Stored XSS via unsanitized input in Youtube Api Key settings leading to script execution when admin saves a value.

17 Jun 2026 06:14Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.8

EPSS0.00402

SSVC