Stored Cross-Site Scripting in Meow Lightbox for WordPress
CVE-2026-109234

7.2HIGH

Key Information:

Vendor

WordPress
Status
Meow Lightbox
Vendor
CVE Published:
31 October 2026

What is CVE-2026-109234?

The Meow Lightbox plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'post_content (bbPress reply body)' parameter. This issue arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to embed arbitrary web scripts in pages. If the administrator has enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, along with a stored-HTML submission surface that retains img attributes, an unauthenticated user can execute arbitrary JavaScript within the context of visitors viewing the affected pages.

Affected Version(s)

Meow Lightbox 0 <= 5.6.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/meow-lightbox/...
https://plugins.trac.wordpress.org/browser/meow-lightbox/...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Santh
.