NAZY-LOAD · CVE-2026-121780 · Package
NO FIX YET · SEE WHAT TO DO
The Flying Images nazy-load WordPress-style plugin by Gijo Varghese fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store input in the affected feature can run script in other users' browsers.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Flying Images nazy-load plugin at version 2.4.15 or earlier are exposed to stored XSS. Sites that do not use this plugin can skip it. The sources do not state which user role must supply the stored input.
Not affected if plugin-not-installed
Who cares nazy-load, web, wordpress
nazy-load plugin is installed and its version is 2.4.15 or earlierImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.