Meow Gallery CVE-2026-9239

Exploitation requires an authenticated WordPress account with author-level capability or higher (PR:L), and the specific vulnerable code path is only reachable when a gallery item is rendered as a link (link_href is non-empty) - galleries whose items are not links are not affected. The injection mechanism relies on WordPress's sanitize_text_field() stripping angle-bracketed tags but preserving double quotes, letting the attacker break out of the aria-label attribute and inject event-handler attributes such as onclick. Execution additionally depends on a victim loading and interacting with the injected page. These factors (trusted-tier authentication, non-default link rendering, and victim interaction) meaningfully limit real-world exploitation despite the network attack vector.

This is a moderate-severity, authenticated stored XSS (CWE-79). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N scores 6.4 and signals network-reachable, low-complexity exploitation, but PR:L is the decisive limiter: the attacker must already hold author-level access or higher on the target WordPress site, which substantially narrows the viable attacker population to trusted/contributor-tier accounts or compromised ones. The scope change (S:C) and C:L/I:L reflect that the injected script executes in the browser context of other users (potentially administrators) rather than impacting the server directly. No CISA KEV listing is present in the input and no EPSS score was provided, so there is no signal of active or probable exploitation - treat the absence of EPSS/KEV as missing data, not as evidence of safety. The vuln.today priority is 'this_month', consistent with a real but non-emergency issue. Net assessment: a genuine privilege-escalation-via-XSS risk on multi-author sites, but not an unauthenticated mass-exploitation threat; prioritize patching where untrusted authors exist, lower urgency on single-admin sites.

An attacker holding an author-level account (or one obtained through a compromised/registered contributor) on a site running Meow Gallery <=5.5.1 sets an image's alt text to a payload using double quotes to break out of the aria-label attribute and add an onclick handler, then configures that gallery item to render as a link. When an administrator or other visitor opens and interacts with the page, the injected script runs in their browser session, enabling session/cookie theft or admin actions. No public exploit was identified at time of analysis.