CVE-2026-109234: Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

Q: Are all installations affected under their normal configuration?

Exploitation requires Output Buffering, the HtmlDomParser engine, and Aggressive Resolve to be enabled. It also requires a stored-HTML submission surface whose kses allow-list preserves img attributes, such as bbPress anonymous replies.

Q: Does an attacker need an account or user interaction to submit the payload?

No authentication is required where an anonymous stored-HTML submission surface is available. A one-time submission is sufficient; the script executes when someone later views the injected page.

Q: Who can be impacted after a successful injection?

Any user who accesses the affected page can execute the attacker-supplied JavaScript in their browser context. The issue can affect confidentiality and integrity, but no availability impact is indicated.

Q: What can be disabled while an update is not available?

Disable at least one required exploitation condition: Output Buffering, the HtmlDomParser engine, Aggressive Resolve, or anonymous stored-HTML submission surfaces that preserve img attributes. Restricting or removing the relevant HTML allowance also prevents the described submission path.

Published Oct 31, 2026

Updated

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page.

Event History

Oct 31, 2026

CVE Published

via MITRE·05:33 AM

Data Sourced

via MITRE·05:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Are all installations affected under their normal configuration?

Exploitation requires Output Buffering, the HtmlDomParser engine, and Aggressive Resolve to be enabled. It also requires a stored-HTML submission surface whose kses allow-list preserves img attributes, such as bbPress anonymous replies.

Does an attacker need an account or user interaction to submit the payload?

No authentication is required where an anonymous stored-HTML submission surface is available. A one-time submission is sufficient; the script executes when someone later views the injected page.

Who can be impacted after a successful injection?

Any user who accesses the affected page can execute the attacker-supplied JavaScript in their browser context. The issue can affect confidentiality and integrity, but no availability impact is indicated.

What can be disabled while an update is not available?

Disable at least one required exploitation condition: Output Buffering, the HtmlDomParser engine, Aggressive Resolve, or anonymous stored-HTML submission surfaces that preserve img attributes. Restricting or removing the relevant HTML allowance also prevents the described submission path.

CVE-2026-109234: Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

Event History

Frequently Asked Questions

Are all installations affected under their normal configuration?

Does an attacker need an account or user interaction to submit the payload?

Who can be impacted after a successful injection?

What can be disabled while an update is not available?

Company

Resources

Contact

Frequently Asked Questions

Are all installations affected under their normal configuration?

Does an attacker need an account or user interaction to submit the payload?

Who can be impacted after a successful injection?

What can be disabled while an update is not available?