Multiple Vulnerabilities Found in Meow Gallery Plugin for WordPress
Article Content
- •CVE-2026-92422 allows unauthenticated shortcode execution, rated 6.5/10.
- •CVE-2026-92423 enables information disclosure for authenticated users, rated 2.7/10.
- •Both vulnerabilities affect Meow Gallery plugin versions before 5.5.5.
Two vulnerabilities have been identified in the Meow Gallery WordPress plugin, affecting versions prior to 5.5.5. CVE-2026-92422, rated 6.5/10 on the CVSS scale, allows unauthenticated users to execute arbitrary shortcodes, potentially disclosing non-public gallery content. CVE-2026-92423, rated 2.7/10, enables authenticated users with Author-level access to disclose details of other users' draft and private posts. The vulnerabilities stem from improper sanitization and capability checks in the plugin. The estimated chance of exploitation for CVE-2026-92422 is low at 0.10% within 30 days. Both vulnerabilities were published on 2026-09-20. Users are advised to update to version 5.5.5 or later to mitigate these risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-33413 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…