EUVD-2026-54384
GHSA-ff3q-prph-g9j7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author-role authentication gates injection (PR:L); victim page load required (UI:R); scope change to victim browser justified by XSS cross-context execution (S:C).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
AnalysisAI
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Technical ContextAI
The affected component is the Meow Gallery WordPress plugin (CPE: cpe:2.3:a:unknown:meow_gallery:*:*:*:*:*:*:*:*) in its linked gallery rendering path. When the plugin builds an anchor tag wrapping a gallery image, it incorporates the attachment's alt text into an HTML attribute without applying WordPress's standard esc_attr() or equivalent sanitization. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) fault: attacker-controlled data from the WordPress media library flows directly into rendered HTML output, persisting server-side and firing on every subsequent page load without further attacker interaction. The S:C scope change in the CVSS vector reflects that the injection executes in the security context of the victim's browser rather than the server.
RemediationAI
Update the Meow Gallery plugin to version 5.5.2 or later, which introduces proper escaping of attachment alt text in gallery link attribute rendering. The patch is confirmed available per WPScan (https://wpscan.com/vulnerability/f76518ec-3abb-4b3c-b592-f5e24059304b/) and EUVD-2026-54384; update via the WordPress plugin dashboard or wp-cli (wp plugin update meow-gallery). If patching is not immediately possible, restrict the Author role exclusively to fully trusted users - downgrade any untrusted contributor accounts to Subscriber or Contributor level, which removes their ability to upload attachments and set alt text. If the linked gallery display mode is configurable, disabling it eliminates the specific injection surface until the patch is applied, though this affects gallery functionality. WAF XSS rules may partially filter known payloads but are not a reliable substitute for the fix and carry a risk of false positives on legitimate gallery content.
More in Meow Gallery
View allThe Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery sh
Blind SQL injection in Meow Gallery up to version 5.4.4 allows high-privileged attackers to extract sensitive data from
Meow Gallery plugin for WordPress (all versions through 5.4.4) exposes an unprotected REST API endpoint that permits any
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today