The Meow Gallery plugin fails to escape an attachment’s alt text before inserting it into the HTML attribute of a gallery link. Authors or higher role users can store arbitrary JavaScript payloads in the alt field; when any visitor, including administrators, views a post containing such a gallery, the script executes in their browser. This permits session hijacking, defacement, or further client‑side attacks, compromising confidentiality and integrity of user sessions.

All WordPress sites running the Meow Gallery plugin prior to version 5.5.2 are affected. The vulnerability applies to every gallery that uses the link attribute constructed from attachment alt text. Site owners relying on older plugin releases must verify their current version.

The vulnerability is a stored client‑side XSS and does not require network exploits; it is limited to users with Author privileges who can edit attachments. No EPSS score is available and the issue is not listed in CISA KEV, implying a lower but still significant discovery frequency. Because the payload runs in every visitor’s browser, the risk of session compromise or defacement is high for sites that have not applied the fix.