Skip to content
Sign in
6.5 Medium

CVE-2026-92422 The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating…

Description

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

Affected products and versions

Product Affected versions Fixed in
Meow Gallery 5.5 earliest → < 5.5.5 5.5.5

Other CVEs of Meow Gallery

The 3 CVEs of Meow Gallery →
CVE-2026-92423 The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the… 2.7 Low CVE-2026-15386 The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an… 5.4 Medium
Track this CVE