CVE-2026-107756 in Meow Lightbox Plugin
Summary
by MITRE • 10/14/2026
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Meow Lightbox plugin for WordPress, specifically in versions up through 5.6.2, contains a critical security flaw classified as Stored Cross-Site Scripting (XSS). This vulnerability arises from insufficient input sanitization and output escaping mechanisms within the application code that handles user-generated content. The specific attack vector involves the combination of the display_name parameter and the comment field. When an authenticated attacker with subscriber-level access or higher interacts with these parameters, they can inject arbitrary web scripts into the database rather than just a single session. This distinguishes it from reflected XSS, as the malicious payload is persisted on the server side, allowing for broader impact across multiple users who view the affected content.
The operational mechanics of this vulnerability are contingent upon specific configuration states within the WordPress environment and the plugin itself. Exploitation requires that the Output Buffering option be enabled in the Meow Lightbox settings; by default, this feature is disabled, which limits the immediate risk profile for many installations but does not eliminate it entirely for those who enable advanced performance features. Furthermore, the attacker must possess at least one previously approved comment on the site. This prerequisite leverages a WordPress core behavior where users with prior approval are granted auto-approval privileges for subsequent comments. By satisfying these conditions, an authenticated low-level user can successfully inject malicious JavaScript code that becomes part of the page content served to other visitors.
The impact of this vulnerability is significant because it allows for persistent session hijacking, defacement, or redirection attacks against any user who views a post containing the injected payload. Since the script executes in the context of the victim's browser with their authentication cookies and privileges, attackers can perform actions on behalf of legitimate users, steal sensitive data such as administrative credentials if an admin visits the compromised page, or spread malware to end-users. This aligns with CWE-79, which describes improper neutralization of input during web page generation, and maps directly to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript-based execution within a browser environment.
Mitigation strategies must address both the immediate vulnerability and broader security hygiene practices. The primary remediation is to upgrade the Meow Lightbox plugin to version 5.6.3 or later, where these input sanitization and output escaping issues have been resolved by the developers. For organizations unable to patch immediately due to compatibility concerns, disabling the Output Buffering option in the plugin settings effectively neutralizes this specific attack vector by preventing the rendering of the vulnerable code path. Additionally, implementing a Web Application Firewall (WAF) with rules designed to detect and block XSS payloads can provide an additional layer of defense. It is also advisable to enforce strict role-based access control policies and review user permissions regularly to ensure that only trusted individuals have comment privileges on public-facing sites.