Meow Gallery public input escapes its intended shortcode context
An unauthenticated user supplies a value concatenated into a shortcode string on a publicly reachable endpoint. The WordPress shortcode parser interprets that untrusted value, permitting arbitrary registered shortcode execution and disclosure of non-public gallery content. The export does not identify the endpoint or parameter. Authoritative affected range: < 5.5.5. Confirmed remediation: 5.5.5.
- Component
- Meow Gallery
- Plugin slug
meow-gallery- Affected
- < 5.5.5
- Safe version
5.5.5- Published
- Sep 20, 2026
This CVE was published Sep 20, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
Update to the applicable fixed release identified in the authoritative export: 5.5.5. Avoid constructing executable shortcode strings from request values. Validate a fixed gallery identifier, enforce access to that gallery, and call only the intended rendering operation.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N