Meow Lightbox: Stored Cross-Site Scripting (CVE-2026-109234)
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_content parameter, allowing unauthenticated attackers to execute arbitrary JavaScript if specific plugin settings are enabled.
CVE search metadata
CVE search record: CVE-2026-109234. Severity: high. CVSS: 7.2. KEV: no. Product: Meow Lightbox (<= 5.6.4). Brief: Meow Lightbox: Stored Cross-Site Scripting (CVE-2026-109234). Brief link: https://feed.craftedsignal.io/briefs/2026-10-meow-lightbox-xss/
Triage facts
Revision 1- Applicability
- Meow Lightbox (<= 5.6.4)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 07:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Meow Lightbox versions 5.6.4 and earlier contain a Stored Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient sanitization of the 'post_content' parameter (specifically in bbPress reply bodies). Exploitation requires specific configuration: the administrator must enable 'Output Buffering', the 'HtmlDomParser' engine, and 'Aggressive Resolve'. Additionally, the environment must support a stored-HTML submission surface (such as bbPress anonymous replies) that allows 'img' attributes. If these conditions are met, an unauthenticated attacker can inject arbitrary scripts that execute in the context of users viewing the injected page.
Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the affected page, including administrators, potentially leading to unauthorized actions or session hijacking.
Recommendation
- Inventory WordPress installations running the Meow Lightbox plugin.
- Update to a version beyond 5.6.4 (if available) or disable the vulnerable plugin.
- If immediate patching is not possible, disable the 'Output Buffering', 'HtmlDomParser', and 'Aggressive Resolve' settings within the Meow Lightbox plugin configuration.
- Audit bbPress and other forum/comment surfaces for anonymous posting configurations that allow HTML tags.
Immediate actions
Inventory all WordPress sites running Meow Lightbox and verify if version 5.6.4 or lower is installed
Threat Hunt
Monitor web server access logs for anomalous POST requests to bbPress reply or comment submission endpoints containing HTML/script tags
Data: Web server logs
Mitigations
Update Meow Lightbox to the latest version or disable the plugin if no patch is available
CVE-2026-109234