# CVE-2026-109234: CVE-2026-109234

Status: published. Published: 2026-10-31. Updated: 2026-11-01.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 7.2 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N; source: NVD: security@wordfence.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1115 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1142 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1276 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L901 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/vendor/kub-at/php-simple-html-dom-parser/src/KubAT/PhpSimple/lib/simple_html_dom.php#L2043 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/vendor/kub-at/php-simple-html-dom-parser/src/KubAT/PhpSimple/lib/simple_html_dom.php#L490 (security@wordfence.com)

- https://plugins.trac.wordpress.org/changeset?old_path=/meow-lightbox/tags/5.6.4&new_path=/meow-lightbox/tags/5.6.5 (security@wordfence.com)

- https://www.wordfence.com/threat-intel/vulnerabilities/id/45fcd17e-10d5-4357-84cc-2527b07b584e?source=cve (security@wordfence.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109234; retrieved 2026-11-02; source updated 2026-11-01

Revision: 8766e1a69c3df569d563b38f041717ca31245916c2b9adb85eae67511ff631f3

Canonical: https://y2.dev/cve/CVE-2026-109234