tigroumeow Meow Lightbox

• CVE-2026-109234 High 7.2 Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization 0.4%
• CVE-2026-107756 Medium 6.4 Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name 0.3%