Flying Images: Stored Cross-Site Scripting (CVE-2026-119175)

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.15. The vulnerability arises from insufficient sanitization and escaping of the 'comment' parameter. Unauthenticated attackers can inject malicious scripts into comments. If an administrator approves the initial comment, subsequent comments from the same author credentials bypass future moderation, enabling the injected script to execute in the browsers of visitors and administrators viewing the affected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users viewing the affected WordPress pages, potentially leading to session hijacking, administrative action performed on behalf of the victim, or credential theft.

Recommendation

• Update the Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin to the latest version beyond 2.4.15 immediately.
• Implement a Web Application Firewall (WAF) to filter common XSS payloads in HTTP POST requests targeting WordPress comment endpoints.
• Audit existing comment sections for unauthorized scripts if the plugin was deployed in a public-facing configuration.