Because the script is injected via comment fields, an attacker must submit a comment containing the crafted payload. The vulnerability is only realized if a site administrator subsequently approves the comment, at which point the malicious payload is served to other users visiting the site. This allows unauthenticated attackers to execute arbitrary JavaScript in the context of other site visitors or administrative sessions.

Attack Chain

1. Attacker crafts an HTTP POST request targeting a public-facing WordPress comment submission form.
2. The 'comment_content' parameter is populated with a payload containing concealed event handlers inside malformed HTML attributes to bypass 'wp_kses_data'.
3. The malicious comment is submitted to the target WordPress instance.
4. The WordPress site administrator reviews the pending comment queue.
5. The administrator approves the crafted comment, causing it to be committed to the site database.
6. The LazyLoad plugin processes the stored comment using its 'str_replace' transformation, converting the concealed handler into an active executable tag.
7. A legitimate user or administrator views the page containing the comment.
8. The injected script executes in the user's browser, enabling session hijacking or further client-side exploitation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of any user who views the infected page. This can lead to account takeover, unauthorized administrative actions, or the theft of session cookies if an administrator views the comment. Given that this requires manual administrative approval, it serves as a persistent, high-impact vector for social engineering or site-wide malware distribution.

Recommendation

Update the LazyLoad Plugin to a version beyond 2.4.0 immediately. If an update is unavailable, disable the plugin or restrict comment posting to authenticated users only. Review current comment queues for suspicious payloads containing malformed HTML attributes or unusual event handlers.