The vulnerability is a stored cross‑site scripting flaw in the WordPress Meow Gallery plugin that allows malicious input to be stored and executed when the gallery page is rendered. This defect can enable an attacker to run arbitrary client‑side code in the browsers of site visitors, potentially compromising confidentiality, integrity, or availability of site content. The weakness is classified as CWE‑79, a failure to properly neutralize otherwise harmful input during web page generation.

The affected product is Jordy Meow’s Meow Gallery for WordPress, specifically all releases from the initial version through 5.2.7. Any WordPress site running one of these plugin versions is vulnerable; newer releases are not listed as affected.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% reveals a very low likelihood of exploitation observed to date. The issue is not listed in the CISA KEV catalog. The likely attack path is an unauthenticated user inputting a malicious script that the plugin stores and later presents to visitors, exploiting the XSS weakness.