Meow Gallery

An Author or higher role can retrieve titles, authors, dates and statuses of other users' draft and private posts because the read path lacks a proper capability check and requester-owned result restriction. The export does not disclose the route or establish full post-body disclosure. Authoritative affected range: < 5.5.5. Confirmed remediation: 5.5.5.

An unauthenticated user supplies a value concatenated into a shortcode string on a publicly reachable endpoint. The WordPress shortcode parser interprets that untrusted value, permitting arbitrary registered shortcode execution and disclosure of non-public gallery content. The export does not identify the endpoint or parameter. Authoritative affected range: < 5.5.5. Confirmed remediation: 5.5.5.

Meow Gallery before 5.5.2 lets an Author store JavaScript in _wp_attachment_image_alt metadata. Meow_MGL_Core::gallery() reads the value for a linked gallery and inserts it without attribute escaping into the link's aria-label, allowing breakout and script execution for visitors including administrators. The media-editing endpoint, required encoding and post-exploitation actions are not disclosed. Version 5.5.2 applies esc_attr().

Meow Gallery is affected by a security weakness. Exploitation requires an authenticated author account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 5.4.4.

Meow Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Meow Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Gallery Block (Meow Gallery) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Meow Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.