The Flying Images plugin contains a stored cross‑site scripting flaw that allows an attacker with administrator privileges to inject arbitrary JavaScript into the plugin’s configuration settings. The injected code is rendered when any visitor loads a page that includes the plugin’s output.

The issue affects the WordPress plug‑in Flying Images: Optimize and Lazy Load Images for Faster Page Speed, versions up to and including 2.4.14. It is relevant for multi‑site WordPress installations or sites where the unfiltered_html capability has been disabled.

The CVSS score of 4.4 indicates medium severity; the EPSS score of less than 1% suggests low utilization probability, and the vulnerability is not listed in CISA KEV. Exploitation requires valid administrator credentials on a multi‑site or unfiltered_html‑restricted site, after which the attacker can inject and persist malicious scripts that execute for any user who views affected pages.