---
id: CVE-2026-9239
title: >-
  Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting
  via Attachment Alt Text (aria-label attribute)
summary: >-
  The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site
  Scripting via Attachment Alt Text (aria-label attribute) in all versions up
  to, and including, 5.5.1 due to insufficient input sanitization and output
  escaping. Thi…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: tigroumeow
product: Meow Gallery
affected:
  - meow_gallery <= 5.5.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:33:50.978497Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:08:58.980Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-9239'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/49afa739-83f0-4ad7-9e5e-d600f293b938?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/core.php#L469
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/core.php#L465
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/run.php#L12
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php#L469
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php#L465
  - url: >-
      https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/run.php#L12
  - url: >-
      https://plugins.trac.wordpress.org/changeset?old_path=/meow-gallery/tags/5.5.1&new_path=/meow-gallery/tags/5.5.2
tags:
  - cve.org
epss: 0.0032
epssPercentile: 0.25073
ingestedAt: '2026-11-05T16:24:31.311Z'
---

## Overview

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.

## Affected

- `meow_gallery <= 5.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.