The vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript in a comment, which is later stored by the WordPress plugin and rendered through the HTML minifier. Because the minifier replaces placeholders using an md5(time()) namespace that can be predicted through the HTTP Date header, the attacker can craft a comment that survives sanitization and is executed in any browser that views the page. This can lead to theft of session cookies, defacement, or other client‑side attacks.

The flaw exists in the W3 Total Cache plugin for WordPress (BoldGrid) for all releases up to and including 2.10.7. Any WordPress site that has this plugin installed and either uses the default ignored‑comment stems list or has HTML Minify enabled is susceptible.

The CVSS score of 5.4 indicates moderate severity. There is no EPSS data available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to post an unauthenticated comment and to predict the placeholder namespace, which can be done by reading the server’s HTTP Date header within the relevant time window. Thus the attack is feasible on sites that expose the comment interface to the public and have Minify enabled.