Threats tagged 'ghsa-ff3q-prph-g9j7'

CVE-2026-15386 is a cross-site scripting (XSS) vulnerability in the Meow Gallery WordPress plugin before version 5.5.2. It occurs because the plugin does not properly escape an attachment's alt text before outputting it into a link attribute for linked galleries. This allows users with Author role or higher to inject JavaScript payloads that execute in the browsers of visitors who view posts containing the affected galleries.