Meow Gallery CVE-2026-15386

Exploitation requires the attacker to hold a WordPress account with at minimum the Author role, granting permission to upload media attachments and set their alt text. The Meow Gallery plugin must be installed, active, and used in linked gallery mode (the display mode that wraps images in anchor tags) on at least one published post or page. The victim must load that specific post or page - no special browser configuration or plugin is required on the victim side. Exploitation is concretely limited by: (1) the authenticated Author-role prerequisite - anonymous visitors and Subscriber/Contributor-role accounts cannot inject payloads; (2) the UI:R requirement - a victim must actively navigate to an affected page; (3) the linked gallery display mode must be in active use on a published post. Sites where all Author-and-above accounts belong to verified, trusted individuals face minimal realistic risk despite the public POC.

The CVSS 5.4 Medium score with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately reflects the attack profile: network-accessible, low-complexity, but gated by a PR:L (Author role) prerequisite and requiring victim page load (UI:R). EPSS at 0.15% (5th percentile) signals very low observed mass-exploitation probability, consistent with the authenticated access requirement that prevents opportunistic automated scanning. However, a public POC is confirmed via WPScan, and SSVC classifies Automatable as 'no' and Technical Impact as 'partial' - meaning exploitation is feasible for targeted attacks but not scalable without pre-existing credential access. The real-world risk is highest for multi-author WordPress sites or platforms offering contributor accounts to external or untrusted users: a malicious author can silently persist a payload that fires when an administrator visits a post, enabling privilege escalation via session theft. The CVSS and EPSS signals are consistent rather than conflicting - the low EPSS reflects limited mass exploitation opportunity, not low severity in targeted scenarios. This is not a CISA KEV entry and shows no evidence of active exploitation at time of analysis.

An attacker with Author-level access to the target WordPress site uploads an image and sets its alt text to a crafted JavaScript payload - for example, a script that exfiltrates document.cookie to an external endpoint. They embed the image in a post using the Meow Gallery linked display mode and publish it. When a site administrator visits the post, the unescaped alt text renders in the anchor tag attribute and the payload executes in the administrator's browser session, delivering the session token to the attacker. A public proof-of-concept is available via WPScan, reducing exploitation complexity.