The Meow Gallery plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.5.1. This flaw arises from insufficient sanitization and escaping of the attachment alt text used in the aria-label attribute. Authenticated users with author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability requires that gallery items are rendered as links and exploits how WordPress sanitizes text fields, allowing injection of event-handler attributes.