The vulnerability allows attackers to inject arbitrary JavaScript into the comment field of the Flying Images plugin, which is stored and later rendered on public pages. Because the plugin does not properly sanitize or escape comment input, the malicious script executes in the browsers of any user who views a page containing the comment, giving attackers the ability to hijack sessions, deface content, or exfiltrate data. The flaw can be exploited by unauthenticated users who submit a comment and gain an administrator’s approval for the first post; after approval, any subsequent comment from the same name and email bypasses moderation, ensuring the payload persists for all future visitors.

WordPress installations using the Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin, versions up to and including 2.4.15, are affected. The plugin’s comment handling code is the root of the issue; any site that has not updated beyond 2.4.15 remains vulnerable.

The CVSS score of 7.2 indicates high severity, and while the EPSS score is not available, the lack of a KEV listing does not diminish the risk because the flaw can be exploited with a simple comment post. The attack path is accessible to unauthenticated users, relying only on ability to submit a comment; once the comment is approved and the script stored, every site visitor becomes a potential victim. Attackers can therefore easily inject code that will run for all users, including administrators, making the vulnerability especially dangerous in shared or multi‑user WordPress environments.