CVE-2026-109234

Name of the Vulnerable Software and Affected Versions Meow Lightbox versions prior to 5.6.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This occurs via the post content (bbPress reply body) parameter, enabling the injection of arbitrary web scripts that execute when a user views the affected page. Exploitation requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, along with a stored-HTML submission surface, such as bbPress anonymous replies, where the kses allow-list preserves img attributes.

Recommendations Update Meow Lightbox to version 5.6.5 or later. As a temporary mitigation, restrict the use of the post content (bbPress reply body) parameter or disable the HtmlDomParser engine and Aggressive Resolve settings.