CVE-2026-2352

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.

• CWE-79

• https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276
• https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804
• https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23514Kiteworks is a private data network (PDN). Versions 9.2.0 an…6.5
• CVE-2026-23515Signal K Server is a server application that runs on a centr…8.8
• CVE-2026-23516CVAT is an open source interactive video and image annotatio…5.4
• CVE-2026-23517Fleet is open source device management software. A broken ac…8.1
• CVE-2026-23518Fleet is open source device management software. In versions…9.8
• CVE-2026-23519RustCrypto CMOV provides conditional move CPU intrinsics whi…9.8
• CVE-2026-23520Arcane provides modern docker management. Prior to 1.13.0, A…8
• CVE-2026-23521Versions of the Traccar open-source GPS tracking system up t…6.5
• CVE-2026-23522LobeChat is an open source chat application platform. Prior …3.7
• CVE-2026-23523Dive is an open-source MCP Host Desktop Application that ena…8.8
• CVE-2026-23524Laravel Reverb provides a real-time WebSocket communication …9.8
• CVE-2026-235251Panel is an open-source, web-based control panel for Linux …8.4