CVE-2026-92422 Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered...

CVE-2026-92422

The Meow Gallery WordPress plugin (versions before 5.5.5 ) contains an unsanitized input vulnerability in the load_gallery_collection REST route. A user-supplied value is concatenated into a shortcode string and passed to the WordPress shortcode parser without proper sanitization, allowing unauth...