CVE-2026-121780: WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated WordPress account?

No. The vector indicates network-based exploitation with no privileges required, although user interaction is required for the attack to succeed.

Q: Which plugin installations should be treated as affected?

Flying Images versions through 2.4.15 are affected. The available data does not identify a fixed version or a configuration-based workaround.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.

Affected Software

1 affected component

Gijo Varghese Flying Images<=2.4.15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Flying Images to a version that resolves this vulnerability.
Fixed in 2.4.16

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

No. The vector indicates network-based exploitation with no privileges required, although user interaction is required for the attack to succeed.

Which plugin installations should be treated as affected?

Flying Images versions through 2.4.15 are affected. The available data does not identify a fixed version or a configuration-based workaround.

CVE-2026-121780: WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

Which plugin installations should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

Which plugin installations should be treated as affected?