Flying Images WordPress plugin stored cross-site scripting via comments

Comments can secretly run harmful actions in visitors' browsers.

Summary

Insufficient input sanitization in the Flying Images comment handling lets an unauthenticated attacker inject scripts that run in the browsers of visitors and administrators. All versions up to and including 2.4.15 are affected.

What to do

No fixed version is named in the sources. Check that the installed plugin is newer than 2.4.15 and read the vendor's advisory.

Products and platforms

Flying Images: Optimize and Lazy Load Images for Faster Page Speed

CVE IDs

CVE-2026-119175 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-07 02:29 UTC

First seen 2026-11-09 18:40 UTC