{"id":"CVE-2026-9239","kind":"vulnerability","aliases":["CVE-2026-9239"],"related":[],"title":"Meow Gallery WordPress plugin: stored XSS via image alt text","description":"The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.","summary":"The Meow Gallery WordPress plugin up to and including 5.5.1 does not sanitize attachment alt text rendered in gallery links. An author-level user can inject script that runs in the browser of anyone who opens the affected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meow-gallery","package","wordpress"],"not_affected_if":["newer-version","no-untrusted-authors","plugin-not-installed"],"how_to_check":"- Check the installed Meow Gallery plugin version in the WordPress admin Plugins screen; versions up to and including `5.5.1` are affected.\n- Look for galleries whose items are rendered as links (link_href set) that use attachment alt text containing quote characters.","fix":"- Move the Meow Gallery plugin to a version later than `5.5.1`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-30T18:18:21+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","triaged_at":"2026-10-30T18:57:01+00:00","updated_at":"2026-10-30T18:57:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:57:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Meow Gallery plugin to a version later than `5.5.1`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Meow Gallery WordPress plugin: stored XSS via image alt text","impact":"medium","summary":"The Meow Gallery WordPress plugin up to and including 5.5.1 does not sanitize attachment alt text rendered in gallery links. An author-level user can inject script that runs in the browser of anyone who opens the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","meow-gallery"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected script runs in visitors' browsers and can act as them","analyst_note":"","how_to_check":"- Check the installed Meow Gallery plugin version in the WordPress admin Plugins screen; versions up to and including `5.5.1` are affected.\n- Look for galleries whose items are rendered as links (link_href set) that use attachment alt text containing quote characters.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","newer-version","no-untrusted-authors"],"who_is_affected":"Sites running the Meow Gallery WordPress plugin version 5.5.1 or earlier, where galleries render items as links. Exploitation needs an author-level account, so sites with no untrusted authors are lower risk. Sites without this plugin or on a newer version can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4301,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-9239':13A,16A '5.5.1':31B,91C 'access':111C,127C 'affect':60B 'allow':175C 'alt':9A,36B,78C 'angl':168C 'angle-bracket':167C 'anyon':56B 'arbitrari':116C 'aria':81C,184C 'aria-label':80C,183C 'attach':35B,77C 'attack':106C,177C 'attribut':83C,186C,193C 'authent':105C 'author':44B,109C 'author-level':43B,108C 'bracket':169C 'break':179C 'browser':54B 'code':133C 'context':187C 'cross':73C 'cross-sit':72C 'cve':11A,14A 'doubl':173C 'due':92C 'empti':153C 'escap':99C 'event':191C 'event-handl':190C 'execut':123C 'exploit':155C 'fact':159C 'field':165C 'galleri':2A,19B,24B,40B,64C,140C 'handler':192C 'href':149C 'i.e':147C 'imag':8A 'includ':30B,90C 'inject':48B,115C,129C,189C 'input':95C 'insuffici':94C 'item':141C 'label':82C,185C 'level':45B,110C 'link':41B,146C,148C 'make':101C 'meow':1A,18B,23B,63C 'meow-galleri':17B 'non':152C 'non-empti':151C 'onclick':196C 'open':58B 'output':98C 'packag':20B 'page':61B,120C,130C 'path':134C 'plugin':4A,26B,65C 'possibl':103C 'preserv':172C 'quot':174C 'reachabl':137C 'reli':156C 'render':38B,143C 'run':51B 'sanit':34B,96C,163C 'script':49B,75C,118C 'site':74C 'store':5A,71C 'strip':166C 'tag':170C 'text':10A,37B,79C,164C 'user':46B,126C 'version':86C 'via':7A,76C 'vulner':69C,132C 'web':117C 'whenev':124C 'wordpress':3A,21B,25B,67C,161C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Meow Gallery WordPress plugin version 5.5.1 or earlier, where galleries render items as links. Exploitation needs an author-level account, so sites with no untrusted authors are lower risk. Sites without this plugin or on a newer version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9239","severity":null,"published_at":"2026-10-30T18:18:21+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","fetched_at":"2026-10-30T18:55:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}