CVE-2026-119175

Name of the Vulnerable Software and Affected Versions The Flying Images: Optimize and Lazy Load Images for Faster Page Speed versions prior to 2.4.16

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts via the comment parameter. While initial submissions may require administrator approval, subsequent comments from the same name and email pair bypass moderation, allowing the script to execute for all visitors, including administrators, when viewing the post from the front end.

Recommendations Update the plugin to version 2.4.16 or later.