Description

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A first-time commenter's submission requires a single administrator approval under the default comment_previously_approved setting; however, once approved, all subsequent comments from the same name and email pair bypass moderation, and the injected script executes for every visitor — including administrators viewing the post from the front end.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T03:17:01.443Z",
  "pubdate": "2026-11-07T03:17:01.443Z",
  "executiveSummary": "The WordPress plugin 'Flying Images: Optimize and Lazy Load Images for Faster Page Speed' (versions <= 2.4.15) contains a Stored Cross-Site Scripting (XSS) vulnerability within the 'comment' parameter.\nThis security flaw allows unauthenticated remote attackers to inject malicious JavaScript into web pages. When a user or administrator views a page containing the injected content, the script executes within the context of their browser session.\nThe vulnerability stems from inadequate input sanitization and output escaping mechanisms. While initial exploitation requires a single administrative approval for a first-time commenter, the system's design permits subsequent comments from the same identity to bypass moderation filters, facilitating persistent payload execution.\nThe risk implication is significant, as it enables unauthorized script execution in the context of the victim's session, potentially leading to credential theft, session hijacking, or unauthorized administrative actions. Mitigation is critical due to the ease of exploitation for unauthenticated actors and the potential for broad impact on both site visitors and privileged administrative users.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), originating from the insecure handling of the 'comment' parameter within the plugin's infrastructure. The root cause is the absence of rigorous server-side input sanitization and corresponding output encoding, allowing raw HTML or JavaScript payloads to be stored in the WordPress database and subsequently rendered in the browser DOM.\nThe attack flow begins with an unauthenticated actor submitting a comment containing a malicious script payload. In the default WordPress configuration, where 'comment_previously_approved' logic is applied, the initial submission is held for administrative review. Once an administrator approves the comment, the payload is persisted. A critical escalation occurs because the application automatically whitelist subsequent comments originating from the same name/email pair. Consequently, the attacker can post further malicious injections that bypass moderation, ensuring continuous execution of the script for all visitors to the affected page.\nWhen a user or administrator accesses the compromised post, the injected script is rendered by the browser as part of the HTML document. Because the script executes within the origin of the WordPress site, it inherits the permissions of the current user. For administrators, this allows the script to perform high-privileged operations, such as creating new administrative accounts, modifying site settings, or redirecting users to malicious external infrastructure.\nThe vulnerability affects all versions of 'Flying Images: Optimize and Lazy Load Images for Faster Page Speed' up to and including 2.4.15. The exploitation is network-exposed, requiring no specific credentials to initiate the initial comment submission. The payload behavior is strictly defined by the attacker, allowing for a wide range of client-side operations including session token exfiltration, DOM manipulation, and automated phishing.\nThis flaw highlights a failure in the plugin's data lifecycle management. By failing to treat user-supplied input as untrusted data, the plugin inadvertently provides a vector for persistent code execution. The bypass of the moderation queue for approved commenters significantly reduces the barrier for sustained, automated exploitation, as the attacker no longer requires manual intervention or repeated approval to deliver new payloads to the site's front-end surface."
}