{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-119175/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:flying_images:flying_images:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-119175"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flying Images: Optimize and Lazy Load Images for Faster Page Speed (\u003c= 2.4.15)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","cve-2026-119175"],"_cs_type":"advisory","_cs_vendors":["Flying Images"],"content_html":"\u003cp\u003eThe Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.15. The vulnerability arises from insufficient sanitization and escaping of the 'comment' parameter. Unauthenticated attackers can inject malicious scripts into comments. If an administrator approves the initial comment, subsequent comments from the same author credentials bypass future moderation, enabling the injected script to execute in the browsers of visitors and administrators viewing the affected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users viewing the affected WordPress pages, potentially leading to session hijacking, administrative action performed on behalf of the victim, or credential theft.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin to the latest version beyond 2.4.15 immediately.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to filter common XSS payloads in HTTP POST requests targeting WordPress comment endpoints.\u003c/li\u003e\n\u003cli\u003eAudit existing comment sections for unauthorized scripts if the plugin was deployed in a public-facing configuration.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:59:05Z","date_published":"2026-11-07T05:59:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-flying-images-xss/","summary":"The Flying Images WordPress plugin version 2.4.15 and earlier contains a stored XSS vulnerability in the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts after comment approval.","title":"Flying Images: Stored Cross-Site Scripting (CVE-2026-119175)","url":"https://feed.craftedsignal.io/briefs/2026-11-flying-images-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-119175","version":"https://jsonfeed.org/version/1.1"}