CVE-2026-15386

Executive Summary

CVE-2026-15386 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Meow Gallery WordPress plugin in versions prior to 5.5.2. The flaw resides in the plugin's failure to properly escape attachment alt-text before embedding it into an HTML attribute during the construction of linked gallery markup, enabling users with the Author role or higher to inject and persistently store arbitrary JavaScript. Any visitor loading a page that renders such a malicious gallery will execute the payload in their browser context, which can lead to full administrative account compromise, site defacement, or the deployment of further malware — making this a high-priority target for organizations running WordPress sites with multiple content contributors.

Technical Analysis

The Meow Gallery plugin builds HTML for "linked galleries" — gallery blocks that link to full-size images or attachment pages. When constructing these links, the plugin inserts an attachment's alt attribute value directly into the title or alt HTML attribute without prior sanitization or output escaping (inadequate esc_attr() usage). Specifically, the vulnerable code path concatenates the raw database-stored alt-text into a string that becomes part of the gallery's generated markup.

The attack surface is the WordPress administrative/media library interface and the post editor. Users with the author role (or higher — editor, administrator) have the capability to upload_files and edit_posts, which allows them to upload media through the built-in media manager. When uploading an image, these users control the alt text field. Alternatively, they can edit an existing attachment's properties to set a malicious alt-text.

The stored payload breaks out of the attribute context using a quote character (e.g., "), then injects an event handler such as onerror, onmouseover, or simply closes the tag and appends a <script> element. Because WordPress core does not sanitize attachment metadata fields (alt-text is stored as post meta _wp_attachment_image_alt without filtering), the malicious string survives in the database indefinitely.

At render time, when a site visitor — including an administrator editing posts or a regular end-user — loads the page containing the linked gallery, the browser parses the injected markup and executes the JavaScript in the origin of the WordPress site. This defeats the same-origin policy protections.

The flaw is triggered only when the gallery is configured with linked images (the "link to" setting set to either media file or attachment page). The default gallery mode or non-linked galleries are not affected. The vulnerable code was introduced in earlier 5.x releases and persisted until the 5.5.2 patch.

Exploitation Scenarios

A complete attack chain against a vulnerable WordPress site with multiple Authors is as follows:

1. Reconnaissance: The attacker identifies a WordPress site running Meow Gallery. This is determined by viewing page source and locating plugin-specific CSS/JS handles such as meow-gallery or /wp-content/plugins/meow-gallery/. Version fingerprinting is done by reading the readme.txt file at /wp-content/plugins/meow-gallery/readme.txt or by observing cached asset versions. The attacker checks wp-login.php to confirm a standard auth flow.

2. Authentication & Weaponization: The attacker authenticates with a valid Author-level account (obtained via credential stuffing, phishing, or legitimate low-privilege access). They navigate to Media → Add New and upload a harmless image file. During upload, or afterward via Media → Library → Edit, the attacker sets the Alt Text field to the following payload — designed to break out of the attribute context:

   " onerror="alert(document.cookie)" data-x="
   

   For a more virulent payload targeting admin compromise, the attacker uses:

   " autofocus onfocus="fetch('/wp-json/wp/v2/users/me',{method:'POST',headers:{'X-WP-Nonce':wpApiSettings.nonce,'Content-Type':'application/json'},body:JSON.stringify({roles:['administrator']})})" x="
   

   This uses the REST API to escalate privileges if the viewing user is an admin.

3. Content Planting: The attacker creates a new post or edits an existing draft/published post. They add a Gallery block and select the malicious image. In the block sidebar, they set "Link To" to either "Media File" or "Attachment Page" (linked gallery mode). The attacker publishes the post or leaves it in draft and sends the preview link to a target admin.

4. Trigger & Execution: When the administrator opens the post (either to review the draft, or via the public URL), the gallery build function concatenates the alt-text into the link HTML:

   <a href="/wp-content/uploads/evil.jpg" title="" onerror="alert(document.cookie)" data-x="">...
   

   The browser parses onerror as a valid event handler. Since the image source is valid, the event may not fire immediately; however, payloads relying on onmouseover or autofocus/onfocus will trigger on interaction or page load. Alternatively, the attacker closes the attribute early and injects a full <script> tag:

   "/><script>fetch('/wp-admin/user-new.php')...</script><a x="
   

   This executes on page load with no interaction required.

5. Post-Exploitation: With code executing in the admin's browser context, the attacker grabs the wp-admin session cookie (if not HttpOnly), creates a rogue administrator account, installs a backdoor plugin, or exfiltrates the database credentials via the site's configuration. At minimum, the attacker achieves persistent stored XSS that survives until the media item's alt-text is manually cleared.

Impact Assessment

The impact of CVE-2026-15386 is elevated due to the privilege threshold and the persistence of the payload:

• Confidentiality: Stored XSS allows JavaScript to read sensitive data from the page DOM, including anti-CSRF tokens, REST API nonces, and any in-page data. Attackers can perform Ajax requests to exfiltrate user lists, plugin configurations, or private post content.
• Integrity: By executing in an admin session, the attacker can modify site content, inject backdoors, change user roles, or alter the plugin's settings. If the plugin manages gallery content for a business — e.g., e-commerce product images — product data can be silently altered.
• Availability: An attacker can delete media, deactivate plugins, or inject a loop that crashes the browser (e.g., while(1)) — affecting all visitors of the poisoned post.
• Blast Radius: Any public-facing page containing the malicious gallery is affected. The XSS is not limited to the administrative dashboard; it executes for every visitor, including customers, partners, and anonymous users.

Severity is rated as High (CVSS 7.0–8.9) given the requirement of an authenticated Author to plant the payload, but the wide visitor base and potential admin session takeover. If the CVSS vector were calculated, the key factors would be AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L or higher. However, the official CVSS is N/A per the CVE record, so no numeric score is asserted.

Detection Guidance

Detection for this vulnerability focuses on two layers: observing the planting (attachment alt-text mutation) and observing the execution (browser-side XSS delivery). Server-side detection of the stored payload is the most reliable because it does not require browser instrumentation.

Sigma Rule

title: Suspicious Attachment Alt-Text in Meow Gallery
id: 5e8f2c1a-9c3d-4b7e-9f1a-2d4e6f8a0b1c
status: experimental
description: Detects suspicious attachment metadata (alt-text) that may indicate a stored XSS payload targeting Meow Gallery linked galleries.
author: Valtersit Threat Intel
date: 2026/06/01
logsource:
  category: application
  product: wordpress
detection:
  selection_db:
    event.action: attachment_updated
    event.outcome: success
  selection_meta:
    meta_key: _wp_attachment_image_alt
    meta_value|re: '(<script|onerror|onload|onfocus|javascript:|<svg|onmouseover|alert\(|fetch\(|eval\(|document\.cookie)'
  condition: selection_db and selection_meta
falsepositives:
  - Legitimate alt-text that mentions the word "script" in non-code context (low likelihood)
  - Security scanner inserting test payloads
level: high
tags:
  - attack.t1059.007
  - attack.t1204.001

YARA Rule

rule wp_meow_gallery_stored_xss_alttext
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects payload patterns in WordPress attachment alt-text known to exploit CVE-2026-15386 (Meow Gallery Stored XSS)"
        reference = "CVE-2026-15386"
        date = "2026-06-01"
        severity = "high"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/ ascii nocase
        $payload2 = /on(error|load|focus|mouseover)\s*=\s*["'][^"']*["']/ ascii nocase
        $payload3 = /javascript\s*:\s*\w/ ascii nocase
        $payload4 = /(alert|prompt|confirm|fetch|eval|document\.cookie)\s*\(/ ascii nocase
        $payload5 = /autofocus\s+onfocus/ ascii nocase
    condition:
        (any of ($payload1, $payload2, $payload3, $payload4, $payload5)) and
        filesize < 1MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-15386 - Meow Gallery Stored XSS via Attachment Alt-Text"; flow:to_server,established; content:"wp-json/wp/v2/media"; nocase; pcre:"/<script|onerror|onfocus|onload|javascript:/i"; classtype:web-application-attack; sid:202615386; rev:1;)

Note: This rule detects the REST API request that plants the malicious alt-text. Because stored XSS delivery targets any browser, network detection is unreliable; host-based detection (EDR) on the client is recommended for execution coverage.

Elastic Detection

sequence by host.name with maxspan=5m
  [ file where process.name : "process_to_monitor" and event.action == "write" and file.path : "*uploads*" ]
  [ any where /* Broad correlation to post-update metadata change */ ]
  /* Focus on the persistence of XSS payloads in attachment meta */

More practical EQL for WordPress audits:

any where event.category == "web" and http.request.body.content : ("*onerror*", "*onfocus*", "*<script>*", "*javascript:*")
  and http.request.body.content : ("*alt*", "*media*", "*attachment*")

Splunk SPL Query

index=wp main sourcetype=access_combined_wcookie
| rex field=uri_path "(?<plugin_handle>meow-gallery)"
| search plugin_handle="meow-gallery" OR uri_path="/wp-json/wp/v2/media/"
| rex field=_raw "(?<payload><script|onerror|onload|onfocus|javascript:)"
| where isnotnull(payload)
| table _time, src_ip, uri, user_agent, status, payload
| stats count by src_ip, payload
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100386" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">attachment_updated</field>
    <regex>(\"meta_value\":\".*(<script|onerror|onfocus|onload|javascript:))</regex>
    <description>WordPress: Potential stored XSS payload in attachment alt-text (CVE-2026-15386)</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>attack.execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

The NVD description states the vulnerability exists "before 5.5.2," implying a patched version exists.

1. Immediate Mitigations (applied before upgrading):

   • Restrict the Author role's media upload and editing capabilities using a capability manager plugin (e.g., remove upload_files, edit_posts) to stop payload injection.
   • Add a WAF rule that blocks HTTP requests containing XSS markers in alt text fields of the WordPress REST API (/wp-json/wp/v2/media).
   • Audit existing attachment alt-text fields across the media library for the payload patterns listed in the YARA rule; use a SQL query to find _wp_attachment_image_alt meta values containing <, ", or on + event names.
   • Until patched, configure galleries to not link to media files or attachment pages (set "Link To" to "None") to disable the vulnerable output path.

2. Patch/Upgrade Steps:

   • From the WordPress admin dashboard, navigate to Plugins → Installed Plugins and check for an update notification for Meow Gallery.
   • Upgrade to version 5.5.2 or later (wp plugin update meow-gallery --allow-root from the command line if shell access is available).
   • After the upgrade, re-run the alt-text audit to confirm no remnants remain. The fix adds proper escaping via esc_attr() on the alt-text output.
   • Verification: Confirm the patch by checking the plugin changelog or readme.txt in the update, or by re-testing a gallery with an alt-text of " onmouseover="alert(1) and observing that it is rendered inert.

3. Long-Term Hardening:

   • Implement a WordPress security plugin that enforces input validation on all post meta fields.
   • Restrict the Author role further: the edit_posts capability is required for legitimate publishing, but consider using a role that allows content creation via a curated editor that sanitizes fields at submission.
   • Enable a Content Security Policy (CSP) with script-src 'self' to limit the impact of any future XSS.
   • Deploy Web Application Firewall rules for WordPress REST API mutation endpoints.
   • Subscribe to the plugin vendor's security advisories or use a vulnerability scanner (WPScan, Patchstack) to monitor upcoming patches.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15386 — Official CVE record with vendor and product details.
2. WordPress Plugin Repository (Meow Gallery): https://wordpress.org/plugins/meow-gallery/ — Source for the patched version 5.5.2 and changelog.
3. Vendor Site (Meow Apps): https://meowapps.com/meow-gallery/ — Vendor advisory and release notes (if published).
4. Patchstack Vulnerability Database: https://patchstack.com/database/ — Reference database listing WordPress plugin vulnerabilities; search for "Meow Gallery."
5. CISA KEV: Not listed (confirmed NOT in the known exploited vulnerabilities catalog at the time of writing).

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No documented in-the-wild exploitation or named threat actor campaign has been publicly attributed to this specific CVE at this time. Exploit code for the general class of stored XSS in WordPress plugin attribute output is widespread in open-source exploit frameworks (ExploitDB, Metasploit auxiliary modules), so weaponization is highly probable. Organizations should treat this as a live risk given the recent publication and the low complexity of the attack.