Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via Duplicated HTML Attributes
- ID
- WPSEC-2026-2175
- Plugin
- Meow Lightbox (meow-lightbox)
- Affected
- all versions before 5.6.5
- Remediation
- Update to 5.6.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-31
- Attack surface
- Meow Lightbox on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-109234, on 2026-10-30.
Description
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags with duplicated attributes in all versions up to, and including, 5.6.4, due to the bundled HTML parser misaligning attribute quoting information when a tag repeats an attribute, which causes a later attribute value to be written back without quotes when the page is re-serialized in Output Buffering mode. This makes it possible for unauthenticated attackers, via comments, as well as contributors via post content, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the non-default Output Buffering option to be enabled, and comments may need to be approved first.
References
- https://wpsec.com/vuln/WPSEC-2026-2175/
- https://plugins.svn.wordpress.org/meow-lightbox/tags/5.6.5/
- https://wordpress.org/plugins/meow-lightbox/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS