The Meow Gallery WordPress plugin before version 5.5.2 fails to escape the alt text of attachments when outputting it into an attribute of the link it builds for linked galleries. This improper sanitization leads to a stored cross-site scripting vulnerability (CWE-79). Users with the Author role or above can exploit this by storing malicious JavaScript code in the alt text, which then executes in the browsers of any visitors, including administrators, who view posts containing the malicious gallery.

An attacker with Author or higher privileges can inject JavaScript code that executes in the context of users viewing the affected gallery posts. This can lead to session hijacking, privilege escalation, or other malicious actions within the affected users' browsers. The vulnerability affects any visitor, including administrators, increasing the risk of administrative account compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role users from uploading or modifying gallery attachments or sanitize alt text inputs manually. Monitor for updates from the Meow Gallery plugin vendor and apply official patches once released.