Meow Lightbox CVE-2026-109234

Exploitation is gated on a specific, stacked, non-default configuration that the attacker does not control: the administrator must have enabled Meow Lightbox's Output Buffering, selected the HtmlDomParser engine, and enabled Aggressive Resolve, AND the site must expose a stored-HTML submission surface (the description cites bbPress anonymous replies) whose kses allow-list still preserves img attributes. Given all of these, a single unauthenticated submission can store a payload that executes JavaScript when any user views the affected page. Limiting factors: the triple plugin-setting requirement plus a permissive kses img allow-list makes vulnerable deployments a minority; sites on default settings, without the HtmlDomParser/Aggressive Resolve path, or without an anonymous stored-HTML surface are not exploitable. Fixed in version 5.6.5.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) portrays an easy, remote, unauthenticated stored-XSS, but the description sharply contradicts the AC:L assumption: exploitation requires the administrator to have simultaneously enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, AND to expose a stored-HTML submission surface (e.g. bbPress anonymous replies) whose kses allow-list still preserves img attributes. These are stacked non-default conditions beyond the attacker's control, so real-world attack complexity is high despite the AC:L in the supplied vector - this is the key signal conflict and defenders should weight it heavily. No EPSS score was provided; there is no CISA KEV listing and no public exploit was supplied (the references are the Wordfence advisory and source-code/changeset links, not exploit code). The vuln.today decision label is 'this_week', indicating a prioritized-but-not-emergency posture, consistent with a credible Wordfence-reported stored XSS that nonetheless depends on an uncommon configuration. Net: this is a legitimate issue to patch on a normal prioritized cadence rather than an emergency, because the headline 7.2/unauthenticated framing overstates ease relative to the config-dependent trigger the description actually requires.

On a site where the administrator has enabled Meow Lightbox's Output Buffering, HtmlDomParser engine, and Aggressive Resolve, and where an anonymous stored-HTML surface such as bbPress anonymous replies passes img attributes through kses, an unauthenticated attacker submits a single crafted reply containing a malicious img payload. The plugin reprocesses the stored HTML on page render and the injected JavaScript then executes in the browser of any user who later views that page. No public exploit code was provided in the sources; the referenced links are the Wordfence advisory and source-code/changeset locations, not a weaponized PoC.