CVE-2026-15386mediumCWE-79

CVE-2026-15386: medium-severity vulnerability in Meow Gallery

Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text

Published

Follow this CVE+ Monitor Meow Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.4epss 0.2%
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Meow Gallery
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Meow Gallery

In the same product, most dangerous first.

CVE-2026-92423LOWMeow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_postsEPSS 0.3%CVE-2026-92422MEDIUMMeow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST RouteEPSS 0.2%