Cpe:2.3:a:meowapps:meow_lightbox:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ameowappsmeow_lightboxwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:51:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMeow Lightbox: Stored Cross-Site Scripting (CVE-2026-109234)https://feed.craftedsignal.io/briefs/2026-10-meow-lightbox-xss/Sat, 31 Oct 2026 07:51:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-meow-lightbox-xss/The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_content parameter, allowing unauthenticated attackers to execute arbitrary JavaScript if specific plugin settings are enabled.Meow Lightbox versions 5.6.4 and earlier contain a Stored Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient sanitization of the 'post_content' parameter (specifically in bbPress reply bodies). Exploitation requires specific configuration: the administrator must enable 'Output Buffering', the 'HtmlDomParser' engine, and 'Aggressive Resolve'. Additionally, the environment must support a stored-HTML submission surface (such as bbPress anonymous replies) that allows 'img' attributes. If these conditions are met, an unauthenticated attacker can inject arbitrary scripts that execute in the context of users viewing the injected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the affected page, including administrators, potentially leading to unauthorized actions or session hijacking.

Recommendation

  • Inventory WordPress installations running the Meow Lightbox plugin.
  • Update to a version beyond 5.6.4 (if available) or disable the vulnerable plugin.
  • If immediate patching is not possible, disable the 'Output Buffering', 'HtmlDomParser', and 'Aggressive Resolve' settings within the Meow Lightbox plugin configuration.
  • Audit bbPress and other forum/comment surfaces for anonymous posting configurations that allow HTML tags.
]]>highadvisoryxsswordpressweb-applicationcms