Stored Cross-Site Scripting Vulnerability in Flying Images Plugin for WordPress

CVE-2026-119175

What is CVE-2026-119175?

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'comment' parameter. This issue affects all versions up to and including 2.4.15 and is primarily due to inadequate input sanitization and output escaping. Attackers can exploit this flaw without authentication, allowing them to inject malicious web scripts into pages. Once a comment is approved by an administrator, any subsequent comments from the same name and email bypass moderation. This enables the injected malicious script to execute for all visitors, including site administrators, whenever they access the compromised page.

References