Stored Cross-Site Scripting in Meow Gallery Plugin for WordPress

CVE-2026-9239

What is CVE-2026-9239?

The Meow Gallery plugin for WordPress presents a vulnerability allowing authenticated attackers with author-level access and above to inject malicious web scripts via the aria-label attribute of attachment alt text. This occurs due to insufficient sanitization and escaping of user inputs, specifically when rendering gallery items as links. Attackers can exploit this if the aria-label contains double quotes, enabling them to break out of the intended context and incorporate event-handler attributes like onclick, leading to unexpected behavior when users visit the affected pages.

References