Kaan Özbek

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.

**Name of the Vulnerable Software and Affected Versions** Meow Gallery versions prior to 5.5.5 **Description** Insufficient capability checks in the `fetch posts` function allow authenticated users with Author-level access or higher to access post data that should be restricted. This flaw enables the disclosure of titles, authors, dates, and statuses of draft and private posts belonging to other users. **Recommendations** Update Meow Gallery to version 5.5.5 or later. As a temporary mitigation, restrict user roles to prevent unauthorized accounts from having Author-level access or higher.