{
 "id": "WPSEC-2026-2175",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2175/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2175/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2175/index.md",
 "title": "Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via Duplicated HTML Attributes",
 "description": "The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags with duplicated attributes in all versions up to, and including, 5.6.4, due to the bundled HTML parser misaligning attribute quoting information when a tag repeats an attribute, which causes a later attribute value to be written back without quotes when the page is re-serialized in Output Buffering mode. This makes it possible for unauthenticated attackers, via comments, as well as contributors via post content, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the non-default Output Buffering option to be enabled, and comments may need to be approved first.",
 "plugin": {
  "slug": "meow-lightbox",
  "name": "Meow Lightbox",
  "full_name": "Meow Lightbox",
  "wordpress_org": "https://wordpress.org/plugins/meow-lightbox/",
  "advisories_url": "https://wpsec.com/vuln/plugin/meow-lightbox/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/meow-lightbox"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.6.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.6.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.6.5",
 "remediation": "Update to 5.6.5 or later.",
 "fix_released": "2026-10-30T06:41:31+00:00",
 "published": "2026-10-31T07:44:03+00:00",
 "updated": "2026-10-30T09:24:28.494003+00:00",
 "also_published_as": {
  "source": "wordfence",
  "cve": [
   "CVE-2026-109234"
  ],
  "published": "2026-10-30T17:16:06+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2175/",
  "https://plugins.svn.wordpress.org/meow-lightbox/tags/5.6.5/",
  "https://wordpress.org/plugins/meow-lightbox/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/meow-lightbox",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-31"
 }
}