The Meow Gallery WordPress plugin versions prior to 5.5.2 fail to escape the alt text of attachments when generating link attributes for linked galleries. This improper sanitization enables users with Author or higher privileges to store malicious JavaScript code that executes in the context of any visitor's browser, including administrators, when they view a post containing such a gallery. This vulnerability is classified as CWE-79 (Cross-Site Scripting) and has a CVSS 3.1 base score of 5.4, indicating a medium severity level. No official patch or remediation details are provided in the available data.

An attacker with Author or higher privileges can inject JavaScript code into the alt text of gallery attachments. This code executes in the browsers of any visitors, including administrators, who view the affected posts. The impact includes limited confidentiality and integrity loss due to script execution in the victim's browser. There is no indication of availability impact. The vulnerability could be used to perform actions such as session hijacking or UI manipulation within the context of the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author role permissions to trusted users only and consider removing or disabling linked galleries that use attachment alt text. Monitor for plugin updates from the vendor addressing this issue.