The CVSS 7.2 on this W3 Total Cache stored XSS is technically accurate but strategically misleading. The vulnerability requires a specific conditional chain: an unauthenticated attacker must inject a malicious author name through a comment, that comment must survive WordPress's moderation workflow, and—critically—the target page must have Lazy Load Images enabled. This isn't a drive-by; it's a staged attack where each condition filters the real blast radius significantly.
The actual vulnerability lives in the LazyLoad mutator, a transformation layer that reconstructs HTML from content that has already passed through WordPress core's sanitization. This is the critical pattern to understand: the mutator assumes comment author names are 'already safe' because they entered WordPress through a sanitized path. That's the anti-pattern. Data sanitized at input time becomes unsafe when re-emitted in a new HTML construction context—the mutator is performing what amounts to secondary emission, and the fix is almost certainly a single esc_html() call at that output point.
What should concern you more than this specific CVE is the architectural question: does W3 Total Cache have other mutators operating under the same broken assumption? This plugin, like many performance optimization tools, has a complex maintenance history with transformation layers that may have accumulated through contributor turnover. The WordPress ecosystem has seen this exact mutation repeatedly—CVE-2015-9132, CVE-2017-14722, and others all followed the same pattern of sanitized content passing through a hook or transform function and being re-output unsafely. Each patch adds esc_html() at one point. None of them fix the underlying mental model.
One practical note that the CVSS doesn't capture: this is a persistent vulnerability. Even after patching, any malicious comments planted before the update remain in your database, live and exploitable, unless you manually purge historical comments. The temporal window extends far beyond the patch deployment. If you're running W3 Total Cache with Lazy Load enabled, audit your comment table now—don't wait for the patch to arrive before understanding what garbage data already exists in your author name fields.