An authenticated subscriber or higher user can inject arbitrary JavaScript through the comment body and display name fields of the Meow Lightbox plugin when its Output Buffering option is enabled. The plugin fails to sanitize or escape these inputs before rendering, allowing the stored script to execute in the browser context of any visitor who views the affected page. This stored XSS flaw carries a CVSS score of 6.4, indicating moderate‑to‑high risk when the conditions are met.

All installations of the Meow Lightbox WordPress plugin up to and including version 5.6.2 are affected. Versions released after 5.6.2 contain a fix that prevents the injection described above.

Because only users with Subscriber-level access or higher can create the malicious input, the attack surface is limited to authenticated accounts that the site trusts. Exploitation also requires the Output Buffering setting to be enabled and comment auto‑approval to be active, conditions that are not the defaults. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of current exploitation. Nevertheless, once a comment is stored, any user who views the page will have the attacker’s script run, enabling session hijacking, defacement, or other client‑side attacks.