What’s Vulnerable › Vulnerabilities
CVE-2026-15386: Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-07 · updated 2026-08-26
- Weakness: CWE-79
Description
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Affected products
- Meow Gallery: before 5.5.2 — fixed in 5.5.2
How to fix
Upgrade to a fixed version: Meow Gallery 5.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15386 or the next vulnerability affects your stack