Meow Lightbox CVE-2026-107756

Exploitation requires THREE concrete conditions, all drawn from the description: (1) an authenticated account at subscriber level or above (CVSS PR:L); (2) the plugin's 'Output Buffering' option must be explicitly enabled - it is DISABLED by default, so default installations are not exploitable; and (3) the attacker must already have at least one previously approved comment on the site, which causes WordPress core to auto-approve their subsequent malicious comment carrying the payload in the 'display_name + comment' parameter. Limiting factors that reduce realistic risk: the non-default Output Buffering requirement, the need for a prior approved comment, and the requirement for any authenticated account (sites without open registration raise the bar further). Payload execution occurs when a user/admin views the injected page.

This is a moderate-severity Stored XSS (CVSS 6.4, CWE-79) whose real-world risk is substantially lower than the headline score suggests because of stacked preconditions. The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) treats the attack as low-complexity, but the description explicitly imposes two non-trivial gates that argue for higher complexity: the plugin's 'Output Buffering' option must be enabled (it is disabled by default), and the attacker must already have at least one previously approved comment so that WordPress core auto-approves subsequent (malicious) comments. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so the exploitation status is 'no public exploit identified at time of analysis' - no SSVC/automatable signals were supplied either. The CVSS vector contains PR:L, so exploitation requires an authenticated account at subscriber level or above, which is often trivially obtainable on sites with open registration but still a barrier versus a fully unauthenticated flaw. Net assessment: a genuine but conditional, low-urgency issue for most deployments - prioritize patching only where open user registration, approved commenters, and the non-default Output Buffering setting coincide. No key signals conflict, but note the input vector's AC:L understates the real-world non-default-configuration and prior-approved-comment requirements.

On a site that has enabled Meow Lightbox's non-default Output Buffering option, an attacker registers a subscriber account (or uses any account with an already-approved comment) and submits a comment whose display name and body carry a malicious script payload; because the author has a prior approved comment, WordPress auto-approves it. When an administrator or other visitor later views the page, the stored script executes in their browser session. No public proof-of-concept was provided in the intelligence sources.