Stored Cross-Site Scripting Vulnerability in Meow Lightbox Plugin for WordPress

CVE-2026-107756

What is CVE-2026-107756?

The Meow Lightbox plugin for WordPress presents a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'display_name + comment' parameters. This flaw permits authenticated attackers, with at least subscriber-level access, to inject malicious web scripts into pages. The exploitation is contingent upon the Output Buffering option being enabled, which is turned off by default. Additionally, attackers must have at least one previously approved comment on the site to facilitate auto-approval of their subsequent comments by WordPress core.

References