The vulnerability exists because the plugin does not properly sanitize or escape the comment author name input. The stored comment data is later reused during the Lazy Load images processing, allowing an attacker to inject arbitrary JavaScript. Unauthenticated users can submit a malicious comment, and any visitor to the affected page will execute the injected script, enabling defacement, cookie theft or execution of arbitrary code in the attacker’s browser context.

This flaw affects the BoldGrid W3 Total Cache WordPress plugin versions up to and including 2.10.3. Any WordPress site that has installed one of those releases and has the Lazy Load Images feature turned on is vulnerable. The issue does not affect other plugins or core WordPress.

The CVSS score of 7.2 reflects a high risk impact. The EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated comment submission and the Lazy Load feature, making it relatively easy to trigger. Once exploited, the script runs in the context of any user who views the page, potentially giving attackers the ability to perform client‑side attacks such as session hijacking or site defacement.