# CVE-2026-9239: Meow Gallery plugin for WordPress stored cross-site scripting in attachment alt text

Source: https://junglewise.ai/threats/cve-2026-9239-the-meow-gallery-plugin-for-wordpress-is-vulnerable-to-stored  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-9239 · Severity: medium · CVSS 6.4 · Published 2026-10-30

The Meow Gallery plugin for WordPress, used to display image galleries on websites, is vulnerable to stored cross-site scripting (XSS) through improperly sanitized attachment alt text. An authenticated user with author-level access or higher can inject malicious scripts into gallery items that execute when other users view the page, potentially compromising visitor accounts and data. This vulnerability requires an attacker to have user access to the WordPress admin and can only be exploited when gallery items are configured as links.

Technologies: [Meow Gallery](https://junglewise.ai/threats/technologies/meow-gallery-1). Vendors: [Meow](https://junglewise.ai/threats/vendors/meow).

## Quick answers

**Is CVE-2026-9239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9239 being exploited in the wild.

**How severe is CVE-2026-9239?** Medium severity, with a CVSS score of 6.4, published 30 October 2026.

**Which products and versions are affected?** Meow Gallery up to and including 5.5.1.

**Is there a fix for CVE-2026-9239?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9239 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9239?** Check whether you run Meow Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Meow Gallery plugin fails to properly sanitize and escape the aria-label attribute in gallery items due to insufficient input validation. WordPress's sanitize_text_field() function removes angle-bracketed tags but preserves double quotes, allowing an authenticated attacker to break out of the aria-label context and inject event-handler attributes like onclick. The vulnerability is only reachable when a gallery item has link_href set (rendering as a link), requiring author-level or higher privileges.

## Affected products

- Meow Gallery up to and including 5.5.1

## Timeline

- 2026-10-30: advisory

## References

- [https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php](https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php)
- [https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php](https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php)

## Related threats

- [Meow Gallery arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-92422-the-meow-gallery-wordpress-plugin-before-5-5-5-does-not-properly)