CVE-2026-9239

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.

• CWE-79

• https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php#L465
• https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/core.php#L469
• https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.5/classes/run.php#L12
• https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/core.php#L465
• https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/core.php#L469
• https://plugins.trac.wordpress.org/browser/meow-gallery/tags/5.4.9/classes/run.php#L12
• https://plugins.trac.wordpress.org/changeset?old_path=/meow-gallery/tags/5.5.1&new_path=/meow-gallery/tags/5.5.2
• https://www.wordfence.com/threat-intel/vulnerabilities/id/49afa739-83f0-4ad7-9e5e-d600f293b938?source=cve

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92383A security vulnerability has been detected in PbootCMS up to…4.3
• CVE-2026-92385A vulnerability has been found in SourceCodester Online Food…2.4
• CVE-2026-92386When writing a long cookie name and value to a Netscape cook…8.1
• CVE-2026-92387By permanently omitting the final control-response line, a m…8.1
• CVE-2026-92388When an FTP wildcard `LIST` operation fails, libcurl omits t…9.1
• CVE-2026-92389libcurl's TFTP state machine fails to validate state transit…8.1
• CVE-2026-92390When invoked with `--remote-header-name` (`-J`), curl fails …7.5
• CVE-2026-92391A deeply nested multipart MIME structure constructed via the…7.5
• CVE-2026-92392During an upload, curl mishandles HTTP/2 `RST_STREAM` receiv…8.1
• CVE-2026-92393Apache YuniKorn 1.9.0 and earlier does not implement label a…2
• CVE-2026-92395@fastify/proxy-addr is a Fastify plugin that determines a re…9.1
• CVE-2026-92397A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(…9.1