CVE-2026-107756

Deferred Deferred - Pending Action

Stored XSS in Meow Lightbox WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107756

EUVD

EUVD-2026-100906

Affected Vendors & Products

Vendor	Product	Version / Range
tigroumeow	Meow	Lightbox 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Meow Lightbox WordPress plugin up to version 5.6.2 has a stored Cross-Site Scripting (XSS) vulnerability. It allows authenticated attackers with subscriber-level access or higher to inject malicious scripts via the display_name and comment parameters. This happens because the plugin fails to properly sanitize input and escape output. The vulnerability only works if the plugin's Output Buffering option is enabled, which is off by default. Attackers need at least one approved comment to exploit this.

Detection Guidance

To detect this vulnerability, check if the Meow Lightbox plugin is installed and active on your WordPress site. Review plugin versions up to 5.6.2. Inspect comments for stored scripts in the display_name or comment fields. Verify if the Output Buffering option is enabled in plugin settings.

Impact Analysis

An attacker could inject malicious scripts into your WordPress site pages. When users visit those pages, the scripts execute, potentially stealing cookies, session tokens, or other sensitive data. This could lead to account takeovers, defacement of your site, or spreading malware to visitors. The impact depends on the attacker's goals and the site's user base.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles if personal data is exposed. For HIPAA, it may risk protected health information exposure if the site handles such data. Non-compliance fines or penalties could apply if the breach results from inadequate security measures.

Mitigation Strategies

Immediately update the Meow Lightbox plugin to the latest version beyond 5.6.2. Disable the Output Buffering option if enabled. Review and remove any suspicious comments with injected scripts. Ensure WordPress comment approval settings are restrictive to prevent auto-approval of attacker comments.

Hi! I’m here to help you understand CVE-2026-107756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70