Cpe:2.3:a:flying_images:flying_images:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aflying_imagesflying_imageswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 05:59:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFlying Images: Stored Cross-Site Scripting (CVE-2026-119175)https://feed.craftedsignal.io/briefs/2026-11-flying-images-xss/Sat, 07 Nov 2026 05:59:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-flying-images-xss/The Flying Images WordPress plugin version 2.4.15 and earlier contains a stored XSS vulnerability in the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts after comment approval.The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.15. The vulnerability arises from insufficient sanitization and escaping of the 'comment' parameter. Unauthenticated attackers can inject malicious scripts into comments. If an administrator approves the initial comment, subsequent comments from the same author credentials bypass future moderation, enabling the injected script to execute in the browsers of visitors and administrators viewing the affected page.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users viewing the affected WordPress pages, potentially leading to session hijacking, administrative action performed on behalf of the victim, or credential theft.

Recommendation

  • Update the Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin to the latest version beyond 2.4.15 immediately.
  • Implement a Web Application Firewall (WAF) to filter common XSS payloads in HTTP POST requests targeting WordPress comment endpoints.
  • Audit existing comment sections for unauthorized scripts if the plugin was deployed in a public-facing configuration.
]]>highadvisoryxssweb-applicationwordpresscve-2026-119175