The vulnerability allows an authenticated user with author‑level access to embed arbitrary JavaScript into the aria‑label attribute of gallery links. Because WordPress’s sanitize_text_field() removes angle brackets but preserves quotation marks, an attacker can close the attribute and add event‑handler attributes such as onclick or onmouseover. When a page renders a gallery item that links to an external URL, the injected script executes in the visitor’s browser, potentially allowing credential theft, session hijacking, or defacement. The flaw exists only when the gallery item is rendered as a link, but that is a common rendering mode for Meow Gallery.

Meow Gallery plugin, versions up to and including 5.5.1, installed on WordPress sites. The vulnerability is specific to the plugin’s handling of attachment alt text in link contexts.

The CVSS score of 6.4 indicates a moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated author‑level access and the ability to add or edit gallery items. Once an attacker injects malicious script, the code runs in the context of any site visitor who opens the gallery page, creating broad impact for users of that site.