{"id":"CVE-2026-92422","published":"2026-09-20T07:16:51.060","lastModified":"2026-09-21T13:34:57.127","description":"The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-345"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/17a94434-3ccc-4282-99f5-d18043673669/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}