Meow Gallery
Monthly
Blind SQL injection in Meow Gallery up to version 5.4.4 allows high-privileged attackers to extract sensitive data from the application database through specially crafted SQL queries. An authenticated administrator with high privileges can exploit this vulnerability without user interaction to perform unauthorized database queries, potentially exposing confidential information. No patch is currently available for affected installations.
Stored cross-site scripting in the Meow Gallery WordPress plugin (all versions up to and including 5.5.1) lets an authenticated author-level user inject script through attachment alt text that is emitted into an aria-label attribute. Because WordPress's sanitize_text_field() strips angle-bracketed tags but leaves double quotes intact, an attacker can break out of the aria-label context and add event-handler attributes such as onclick that fire when a visitor views the injected gallery page. The vulnerable sink is only reached when gallery items are rendered as links (a non-empty link_href), and a patch appears in the 5.5.1-to-5.5.2 changeset; no public exploit code or active exploitation was identified at time of analysis, and the priority label is this_month rather than immediate action.
Authorization bypass in the Meow Gallery plugin for WordPress, in all versions up to and including 5.5.4, lets any authenticated user holding author-level access or higher enumerate and read metadata - post ID, title, date, author and status - for every private and draft post on the site, including unpublished content belonging to other users. The root cause is a missing capability check on the plugin's REST handlers and core class (CWE-862), reachable remotely with PR:L and no user interaction against default configurations. Wordfence rates the issue 6.5, while our assessment narrows the confidentiality impact to metadata disclosure rather than post body content; no public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Information disclosure in the Meow Gallery WordPress plugin before 5.5.5 lets authenticated users holding Author-level access or higher pull back metadata - titles, authors, dates and publish statuses - belonging to other users' draft and private posts. The vulnerable post-data retrieval routine performs neither a proper capability check nor owner-scoping of results, so a low-trust Author account on a multi-author site can enumerate unpublished content it was never meant to see; post bodies themselves are not exposed and there is no write, modify or denial-of-service impact. A publicly available exploit code exists, but the flaw is not confirmed actively exploited (no CISA KEV listing), and the risk is genuinely low-priority: it is not reachable by anonymous visitors, requires a valid Author-or-higher login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in our assessment), and matters mainly on sites where lower-trust Author accounts coexist with genuinely sensitive unpublished material.
Unauthenticated attackers can invoke arbitrary registered shortcodes on WordPress sites running the Meow Gallery plugin before version 5.5.5, due to insufficient sanitization of a user-supplied value concatenated into a shortcode string on a publicly reachable endpoint. This allows disclosure of non-public gallery content, but does not permit code execution or availability impact; publicly available exploit code exists, and the vendor has released a patch (5.5.5).
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Meow Gallery plugin for WordPress (all versions through 5.4.4) exposes an unprotected REST API endpoint that permits any authenticated user with Author-level access or above to overwrite or create arbitrary gallery shortcode records by supplying a user-controlled `id` parameter. The endpoint `/wp-json/meow-gallery/v1/save_shortcode` performs direct database write operations without verifying ownership of the referenced record, making this a classic CWE-639 (IDOR) pattern. No public exploit or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and wide availability of Author-level accounts in multi-contributor WordPress environments elevate real-world risk above what the CVSS 4.3 score alone suggests.
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Blind SQL injection in Meow Gallery up to version 5.4.4 allows high-privileged attackers to extract sensitive data from the application database through specially crafted SQL queries. An authenticated administrator with high privileges can exploit this vulnerability without user interaction to perform unauthorized database queries, potentially exposing confidential information. No patch is currently available for affected installations.
Stored cross-site scripting in the Meow Gallery WordPress plugin (all versions up to and including 5.5.1) lets an authenticated author-level user inject script through attachment alt text that is emitted into an aria-label attribute. Because WordPress's sanitize_text_field() strips angle-bracketed tags but leaves double quotes intact, an attacker can break out of the aria-label context and add event-handler attributes such as onclick that fire when a visitor views the injected gallery page. The vulnerable sink is only reached when gallery items are rendered as links (a non-empty link_href), and a patch appears in the 5.5.1-to-5.5.2 changeset; no public exploit code or active exploitation was identified at time of analysis, and the priority label is this_month rather than immediate action.
Authorization bypass in the Meow Gallery plugin for WordPress, in all versions up to and including 5.5.4, lets any authenticated user holding author-level access or higher enumerate and read metadata - post ID, title, date, author and status - for every private and draft post on the site, including unpublished content belonging to other users. The root cause is a missing capability check on the plugin's REST handlers and core class (CWE-862), reachable remotely with PR:L and no user interaction against default configurations. Wordfence rates the issue 6.5, while our assessment narrows the confidentiality impact to metadata disclosure rather than post body content; no public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Information disclosure in the Meow Gallery WordPress plugin before 5.5.5 lets authenticated users holding Author-level access or higher pull back metadata - titles, authors, dates and publish statuses - belonging to other users' draft and private posts. The vulnerable post-data retrieval routine performs neither a proper capability check nor owner-scoping of results, so a low-trust Author account on a multi-author site can enumerate unpublished content it was never meant to see; post bodies themselves are not exposed and there is no write, modify or denial-of-service impact. A publicly available exploit code exists, but the flaw is not confirmed actively exploited (no CISA KEV listing), and the risk is genuinely low-priority: it is not reachable by anonymous visitors, requires a valid Author-or-higher login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in our assessment), and matters mainly on sites where lower-trust Author accounts coexist with genuinely sensitive unpublished material.
Unauthenticated attackers can invoke arbitrary registered shortcodes on WordPress sites running the Meow Gallery plugin before version 5.5.5, due to insufficient sanitization of a user-supplied value concatenated into a shortcode string on a publicly reachable endpoint. This allows disclosure of non-public gallery content, but does not permit code execution or availability impact; publicly available exploit code exists, and the vendor has released a patch (5.5.5).
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Meow Gallery plugin for WordPress (all versions through 5.4.4) exposes an unprotected REST API endpoint that permits any authenticated user with Author-level access or above to overwrite or create arbitrary gallery shortcode records by supplying a user-controlled `id` parameter. The endpoint `/wp-json/meow-gallery/v1/save_shortcode` performs direct database write operations without verifying ownership of the referenced record, making this a classic CWE-639 (IDOR) pattern. No public exploit or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and wide availability of Author-level accounts in multi-contributor WordPress environments elevate real-world risk above what the CVSS 4.3 score alone suggests.
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.