Meow Lightbox
Monthly
Stored cross-site scripting in the Meow Lightbox WordPress plugin (all versions up to and including 5.6.2) allows an authenticated subscriber-level user to inject arbitrary script through the 'display_name + comment' parameter, which then executes in the browser of any user viewing the injected page. Real-world risk is substantially lower than the 6.4 headline score suggests because three preconditions must all be met: the plugin's Output Buffering option must be explicitly enabled (it is disabled by default), the attacker must already have at least one approved comment on the site so that WordPress core auto-approves subsequent submissions, and any authenticated account (PR:L) is required - making default installations non-exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal is present in the available intelligence.
Stored cross-site scripting in the Meow Lightbox WordPress plugin (all versions up to and including 5.6.2) allows an authenticated subscriber-level user to inject arbitrary script through the 'display_name + comment' parameter, which then executes in the browser of any user viewing the injected page. Real-world risk is substantially lower than the 6.4 headline score suggests because three preconditions must all be met: the plugin's Output Buffering option must be explicitly enabled (it is disabled by default), the attacker must already have at least one approved comment on the site so that WordPress core auto-approves subsequent submissions, and any authenticated account (PR:L) is required - making default installations non-exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal is present in the available intelligence.