WordPress Meow Lightbox Plugin Stored Cross-Site Scripting (Stored XSS) Vulnerability (CVE-2026-109234)

1. Apply Official Security Patch

The recommended resolution is to upgrade the Meow Lightbox plugin to version 5.6.5 or later. You can update via the WordPress Dashboard or using WP-CLI:

# Update plugin via WP-CLI
wp plugin update meow-lightbox

2. Temporary Mitigation Workarounds

If patching cannot be performed immediately, mitigate the risk by disabling the required exploit preconditions:

• Disable Vulnerable Features: Turn off the HtmlDomParser engine or disable the Aggressive Resolve option within the Meow Lightbox settings.
• Restrict Anonymous Submissions: Disable anonymous posting/replies in bbPress or other forum plugins to prevent unauthenticated input.
• WAF (Web Application Firewall) Rule: Deploy a rule to inspect and block malicious HTML event handlers in the post_content parameter.

  # Example WAF Rule to block malicious img attributes
  SecRule ARGS:post_content "(?i)<img[^>]+(onerror|onload|onmouseover)\s*=" "id:109234,deny,status:403,log,msg:'CVE-2026-109234 XSS Attack Blocked'"

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting (Stored XSS, CWE-79) due to insufficient input sanitization and output escaping in the processing of post content.

An unauthenticated attacker can exploit this by submitting malicious payloads via the post_content parameter (such as bbPress reply bodies). For the exploit to succeed, the following specific preconditions must be met on the target site:

• The administrator must have enabled Output Buffering.
• The HtmlDomParser engine must be active.
• The Aggressive Resolve feature must be enabled.
• A stored-HTML submission surface (e.g., bbPress anonymous replies) must exist where the kses allow-list preserves img attributes.

When these conditions are satisfied, a single unauthenticated submission can permanently store arbitrary JavaScript on the page, leading to session hijacking, defacement, or unauthorized administrative actions when viewed by other users.