CVE-2026-15386: Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15386?
The severity of CVE-2026-15386 is rated at 45.
How do I fix CVE-2026-15386?
To fix CVE-2026-15386, update the Meow Gallery WordPress plugin to version 5.5.2 or later.
Who is affected by CVE-2026-15386?
CVE-2026-15386 affects users with the Author role or higher in the Meow Gallery WordPress plugin.
What type of vulnerability is CVE-2026-15386?
CVE-2026-15386 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
What is the impact of CVE-2026-15386 on website visitors?
The impact of CVE-2026-15386 allows stored JavaScript payloads to execute in the browsers of any website visitor.