# Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via Duplicated HTML Attributes

- **ID:** WPSEC-2026-2175
- **Plugin:** Meow Lightbox (`meow-lightbox`), https://wordpress.org/plugins/meow-lightbox/
- **Affected versions:** all versions before 5.6.5
- **Fixed in:** 5.6.5 (Update to 5.6.5 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/meow-lightbox
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2175/

## Description

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags with duplicated attributes in all versions up to, and including, 5.6.4, due to the bundled HTML parser misaligning attribute quoting information when a tag repeats an attribute, which causes a later attribute value to be written back without quotes when the page is re-serialized in Output Buffering mode. This makes it possible for unauthenticated attackers, via comments, as well as contributors via post content, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the non-default Output Buffering option to be enabled, and comments may need to be approved first.

Also published later by wordfence as CVE-2026-109234.

## References

- https://wpsec.com/vuln/WPSEC-2026-2175/
- https://plugins.svn.wordpress.org/meow-lightbox/tags/5.6.5/
- https://wordpress.org/plugins/meow-lightbox/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2175/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.