CVE-2026-92422

Name of the Vulnerable Software and Affected Versions Meow Gallery versions prior to 5.5.5

Description Insufficient sanitization of user-supplied values allows unauthenticated users to execute arbitrary registered shortcodes. This occurs when input is concatenated into a shortcode string and passed to the WordPress shortcode parser via the /load gallery collection REST endpoint. This flaw can lead to the disclosure of non-public gallery content.

Recommendations Update Meow Gallery to version 5.5.5 or later. Restrict access to the /load gallery collection endpoint as a temporary mitigation measure.