{"id":"CVE-2026-121780","kind":"vulnerability","aliases":["CVE-2026-121780"],"related":[],"title":"Flying Images lazy-load plugin: stored XSS through image handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.","summary":"The Flying Images nazy-load WordPress-style plugin by Gijo Varghese fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store input in the affected feature can run script in other users' browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nazy-load","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["nazy-load","package","web","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `nazy-load` plugin is installed and its version is `2.4.15` or earlier","fix":"- Fixed version: unknown","status":"open","published_at":"2026-11-09T10:17:07+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:14+00:00","updated_at":"2026-11-09T10:26:14+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T10:26:14Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown\n- unknown","reach":"internet","title":"Flying Images lazy-load plugin: stored XSS through image handling","impact":"medium","summary":"The Flying Images nazy-load WordPress-style plugin by Gijo Varghese fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store input in the affected feature can run script in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","nazy-load","web"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Confirm the affected product platform, the fixed version after 2.4.15, and the required privilege level at https://nvd.nist.gov/vuln/detail/CVE-2026-121780","how_to_check":"- Check whether the `nazy-load` plugin is installed and its version is `2.4.15` or earlier\n- unknown","plain_action":"","product_name":"nazy-load","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Flying Images nazy-load plugin at version 2.4.15 or earlier are exposed to stored XSS. Sites that do not use this plugin can skip it. The sources do not state which user role must supply the stored input.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4548,"output_tokens":548,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121780':14A,17A '-2026':13A,16A '2.4.15':102C 'affect':62B,96C 'allow':48B,92C 'attack':55B 'browser':70B 'cross':51B,80C 'cross-sit':50B,79C 'cve':12A,15A 'fail':40B 'featur':63B 'fli':1A,28B,87C,97C 'generat':45B,78C 'gijo':38B,85C 'handl':11A 'imag':2A,10A,29B,88C,98C 'improp':71C 'input':43B,59B,74C 'issu':95C 'lazi':4A 'lazy-load':3A 'load':5A,20A,23B,32B,91C 'n/a':100C 'nazi':22B,31B,90C 'nazy':19A 'nazy-load':18A,21B,30B,89C 'neutral':42B,72C 'packag':24B 'page':47B,77C 'plugin':6A,36B 'run':65B 'script':53B,66B,82C 'site':52B,81C 'store':7A,49B,58B,93C 'style':35B 'user':69B 'varghes':39B,86C 'vulner':83C 'web':25B,46B,76C 'wordpress':26B,34B 'wordpress-styl':33B 'xss':8A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Flying Images nazy-load plugin at version 2.4.15 or earlier are exposed to stored XSS. Sites that do not use this plugin can skip it. The sources do not state which user role must supply the stored input.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["nazyload"],"ptokens":["load","nazy"],"labels":["high","nazyload","package","vendor","web","wordpress"],"campaign_type":null,"search_a":"'-121780':14A,17A '-2026':13A,16A 'cve':12A,15A 'fli':1A 'handl':11A 'imag':2A,10A 'lazi':4A 'lazy-load':3A 'load':5A,20A 'nazy':19A 'nazy-load':18A 'plugin':6A 'store':7A 'xss':8A","search_b":"'affect':62B 'allow':48B 'attack':55B 'browser':70B 'cross':51B 'cross-sit':50B 'fail':40B 'featur':63B 'fli':28B 'generat':45B 'gijo':38B 'imag':29B 'input':43B,59B 'load':23B,32B 'nazi':22B,31B 'nazy-load':21B,30B 'neutral':42B 'packag':24B 'page':47B 'plugin':36B 'run':65B 'script':53B,66B 'site':52B 'store':49B,58B 'style':35B 'user':69B 'varghes':39B 'web':25B,46B 'wordpress':26B,34B 'wordpress-styl':33B","search_c":"'2.4.15':102C 'affect':96C 'allow':92C 'cross':80C 'cross-sit':79C 'fli':87C,97C 'generat':78C 'gijo':85C 'imag':88C,98C 'improp':71C 'input':74C 'issu':95C 'load':91C 'n/a':100C 'nazi':90C 'nazy-load':89C 'neutral':72C 'page':77C 'script':82C 'site':81C 'store':93C 'varghes':86C 'vulner':83C 'web':76C 'xss.this':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121780","severity":null,"published_at":"2026-11-09T10:17:07+00:00","modified_at":"2026-11-09T10:17:07+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}