{"id":"CVE-2026-9239","aliases":["EUVD-2026-114217","GHSA-93vw-w9vm-pp4x"],"status":"published","title":"Meow Gallery \u003c= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)","description":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0032,"percentile":0.25122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-30T17:15:26Z","modified":"2026-10-30T19:20:29Z","products":[{"vendor":"jordy meow","product":"meow gallery"},{"vendor":"tigroumeow","product":"meow gallery"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49afa739-83f0-4ad7-9e5e-d600f293b938?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/core.php#L469"},{"url":"https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/core.php#L465"},{"url":"https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/run.php#L12"},{"url":"https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php#L469"},{"url":"https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php#L465"},{"url":"https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/run.php#L12"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=/meow-gallery/tags/5.5.1\u0026new_path=/meow-gallery/tags/5.5.2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9239"},{"url":"https://github.com/advisories/GHSA-93vw-w9vm-pp4x"}],"sources":{"cve":[{"id":"CVE-2026-9239","title":"Meow Gallery \u003c= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)","description":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.","status":"published","published":"2026-10-30T17:15:26.845Z","modified":"2026-10-30T18:08:58.98Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:42:26.790871Z"}],"euvd":[{"id":"EUVD-2026-114217","description":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.","status":"published","published":"2026-10-30T17:15:26Z","modified":"2026-10-30T18:08:58Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-93vw-w9vm-pp4x","title":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment...","description":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.","status":"published","published":"2026-10-30T18:32:46Z","modified":"2026-10-30T18:32:53Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-9239","description":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.","status":"published","published":"2026-10-30T18:18:21.613Z","modified":"2026-10-30T19:20:29.18Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:05.268617Z"}]}}