W3 Total Cache CVE-2026-78438

Two non-default feature conditions must both be active: (1) the 'Lazy Load Images' feature in W3 Total Cache must be enabled, and (2) the 'Process background images' sub-option within that feature must also be enabled. Additionally, a site moderator must approve the malicious comment before the payload is served to visitors - on sites with open or automated comment approval, this gating step is effectively eliminated. The attacker requires no authentication. Execution is triggered passively when any user loads a page containing the approved comment. Sites that disable comments entirely, use comment moderation queues with careful review, or do not enable background-image lazy loading are not exploitable via this path.

The CVSS 7.2 score with AV:N/AC:L/PR:N/UI:N/S:C overstates realistic exploitability in two ways: UI:N misrepresents stored XSS, which inherently requires a victim to visit the page, and the score does not account for the moderator-approval prerequisite that gates payload delivery. In practice, an attacker must craft a comment that evades the content moderation review step - either through social engineering (submitting a seemingly benign comment that embeds the payload in a CSS background-image value not obviously suspicious in moderation view) or on sites with permissive or automated approval workflows. The secondary condition - Lazy Load Images with background processing enabled - is a plausible default on performance-tuned WordPress deployments, as this is a key selling point of the plugin. No KEV listing and no public proof-of-concept are identified, with EPSS data absent from this report. Even a mid-sized municipal IT team in bytom running a public-facing WordPress site with reader comments enabled should treat this as a meaningful risk to visitor sessions, particularly given W3 Total Cache's broad installed base. The scope-change (S:C) is accurate - victim browsers, not the WordPress server itself, bear the confidentiality and integrity impact.

An attacker submits a WordPress comment containing a crafted CSS background-image value embedding a malicious JavaScript payload, designed to appear visually innocuous to a moderator reviewing it. Once the moderator approves the comment, any user who visits the page on a site running W3 Total Cache with Lazy Load background image processing enabled will have the script execute in their browser context, enabling session cookie theft or account hijacking. No authentication is required from the attacker, and no published proof-of-concept has been identified at time of analysis.