CVE-2026-92422Medium· 6.5▾ SunlitThe Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing u…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
— → 6.5
none → medium
Last analysed / modified upstream
0.1% → 0.1%
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92423Low· 2.7The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above …
CVE-2026-49450High· 7.1Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks
CVE-2026-71576High· 8.5A flaw was found in multicluster-global-hub
CVE-2026-92400Medium· 5.3The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account bef…
CVE-2026-63405Medium· 5.9AnyCable is a realtime server for reliable two-way communication that supports any backend
CVE-2026-62874Critical· 10.0Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.