{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/meow-lightbox--5.6.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:meowapps:meow_lightbox:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109234"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Meow Lightbox (\u003c= 5.6.4)"],"_cs_severities":["high"],"_cs_tags":["xss","wordpress","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["Meow Apps"],"content_html":"\u003cp\u003eMeow Lightbox versions 5.6.4 and earlier contain a Stored Cross-Site Scripting (XSS) vulnerability. The issue arises from insufficient sanitization of the 'post_content' parameter (specifically in bbPress reply bodies). Exploitation requires specific configuration: the administrator must enable 'Output Buffering', the 'HtmlDomParser' engine, and 'Aggressive Resolve'. Additionally, the environment must support a stored-HTML submission surface (such as bbPress anonymous replies) that allows 'img' attributes. If these conditions are met, an unauthenticated attacker can inject arbitrary scripts that execute in the context of users viewing the injected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the affected page, including administrators, potentially leading to unauthorized actions or session hijacking.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory WordPress installations running the Meow Lightbox plugin.\u003c/li\u003e\n\u003cli\u003eUpdate to a version beyond 5.6.4 (if available) or disable the vulnerable plugin.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the 'Output Buffering', 'HtmlDomParser', and 'Aggressive Resolve' settings within the Meow Lightbox plugin configuration.\u003c/li\u003e\n\u003cli\u003eAudit bbPress and other forum/comment surfaces for anonymous posting configurations that allow HTML tags.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:51:18Z","date_published":"2026-10-31T07:51:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-meow-lightbox-xss/","summary":"The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_content parameter, allowing unauthenticated attackers to execute arbitrary JavaScript if specific plugin settings are enabled.","title":"Meow Lightbox: Stored Cross-Site Scripting (CVE-2026-109234)","url":"https://feed.craftedsignal.io/briefs/2026-10-meow-lightbox-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Meow Lightbox (\u003c= 5.6.4)","version":"https://jsonfeed.org/version/1.1"}