Description

The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-07T06:16:55.720Z",
  "pubdate": "2026-08-07T06:16:55.720Z",
  "executiveSummary": "The Meow Gallery WordPress plugin before version 5.5.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output encoding.\nThe vulnerability allows authenticated users with the Author role or higher to inject arbitrary JavaScript payloads into an attachment's alt text field.\nWhen a linked gallery is rendered, the unescaped alt text is output directly into an HTML attribute of the generated link.\nThe malicious payload executes within the browser context of any visitor, including high-privileged administrators, upon viewing a post containing the affected gallery.\nThis introduces severe risk implications, potentially leading to unauthorized administrative actions, session hijacking, or site defacement depending on the privileges of the victim viewing the content.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper output escaping for attachment alt text when constructing HTML attributes for linked galleries.\nThe vulnerable component is responsible for generating links for galleries within the Meow Gallery WordPress plugin, specifically affecting versions prior to 5.5.2.\nExploitation requires authenticated access with an Author role or above, enabling the attacker to modify media attachment metadata within the WordPress media library.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious JavaScript payload disguised within the alt text of a media attachment. Second, the attacker embeds a linked gallery utilizing this specific attachment into a WordPress post or page. Third, a victim or administrator visits the rendered post. Fourth, the plugin retrieves the attachment metadata and outputs the alt text directly into an HTML attribute without sanitization or contextual HTML entity encoding. Finally, the browser parses the attribute, executes the embedded JavaScript payload in the context of the victim's session, and achieves the desired payload behavior."
}