Threats tagged 'ghsa-vv6j-8xxc-xhcc'

The Meow Lightbox WordPress plugin up to version 5.6.4 is vulnerable to stored cross-site scripting (XSS) via the 'post_content' parameter used in bbPress reply bodies. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary JavaScript. Exploitation requires specific plugin settings enabled by the administrator, including Output Buffering, the HtmlDomParser engine, Aggressive Resolve, and a stored-HTML submission surface with a permissive kses allow-list. When these conditions are met, the injected script executes in the context of any user viewing the affected page.