WordPress Meow Lightbox plugin <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Meow Lightbox versions = 5.6.2...

CVE-2026-107756

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-107756

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.6.2 . The flaw stems from insufficient input sanitization and output escaping of the display_name + comment parameters. An authenticated attacker with subscriber-level acces...

CVE-2026-107756 Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-100906

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-113719

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...