CVE-2026-9239
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Meow Gallery plugin for WordPress is vulnerable to stored cross-site scripting via Attachment Alt Text (aria-label attribute) in all versions up to and including 5.5.1 due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker with author-level access can execute malicious JavaScript in victims' browsers, potentially leading to session hijacking or data theft.
Recommendation
Update the Meow Gallery plugin to a version later than 5.5.1 and restrict author privileges where possible.
Other vulnerabilities in Meow Gallery WordPress plugin
See all- CVE-2026-13747Medium
The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.5.4 because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with author-level access or above can enumerate and read metadata of all private and draft posts, including post ID, title, date, author, and status.
- CVE-2026-92423Low
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data. This allows authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
- CVE-2026-92422Medium
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint. This allows unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
Original NVD description (English source)
The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS