W3 Total Cache CVE-2026-18109

Two conditions must both be true for exploitation to succeed: (1) the W3 Total Cache plugin's Lazy Load Images feature must be explicitly enabled in plugin settings - the CVE description confirms that the vulnerable code path exists exclusively within the LazyLoad mutator's img tag rewriting step and is inert when this feature is disabled; (2) the WordPress site must permit public comment submission, since the injection vector is the Comment Author Name field provided during comment posting. Per the CVSS vector PR:N, no authentication is required from the attacker's side once these conditions are met. Exploitation is limited by: Lazy Load Images being an opt-in configuration that is not universally active across all W3 Total Cache deployments, the requirement that the site permits unauthenticated or minimally-verified comment submission, and the fact that the injected payload only fires on pages that both display the affected comment and are processed by the LazyLoad mutator. Comment moderation queues or CAPTCHA reduce but do not eliminate the attack surface.

The assigned CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2) reflects a network-accessible, unauthenticated stored XSS with scope change into victim browsers. A notable analytical tension exists in the AC:L rating: the CVE description explicitly states that exploitation is only possible when the Lazy Load Images feature is enabled - a deployment condition entirely beyond attacker control, which by CVSS 3.1 specification would conventionally support AC:H rather than AC:L. The assigned vector likely reflects the reporter's view that lazy load is commonly enabled among W3 Total Cache users, but it arguably overstates exploitability against the full installation population. S:C is well-justified because the payload executes in a security context distinct from the server - the victim's browser. No KEV listing and no POC code availability are present in the provided data, so active exploitation is unconfirmed. EPSS data was not provided. Real-world priority is moderate-to-high for sites that have both commenting and lazy load active, and lower for the broader W3 Total Cache install base where lazy load may be disabled.

An unauthenticated attacker submits a WordPress comment with a JavaScript payload embedded in the Comment Author Name field - for example, a name containing an injected event handler or script tag. When W3 Total Cache's LazyLoad mutator subsequently processes any page that renders that comment, it injects the unsanitized author name into rewritten img tag HTML, causing the script to execute automatically in the browser of every visitor to that page, enabling session token exfiltration, credential harvesting via fake login overlays, or drive-by malware delivery. No public exploit code is identified at time of analysis.