CVE-2026-2352

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2352", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-11T16:37:03.973Z", "datePublished": "2026-03-20T23:25:12.386Z", "dateUpdated": "2026-04-08T16:56:20.012Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:20.012Z"}, "affected": [{"vendor": "optimizingmatters", "product": "Autoptimize", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration."}], "title": "Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804"}, {"url": "https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Hung Nguyen"}], "timeline": [{"time": "2026-02-11T16:53:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-20T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:42:22.789814Z", "id": "CVE-2026-2352", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:42:29.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2352", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:42:22.789814Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:42:25.778Z"}}], "cna": {"title": "Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value", "credits": [{"lang": "en", "type": "finder", "value": "Hung Nguyen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "optimizingmatters", "product": "Autoptimize", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-11T16:53:35.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-20T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276"}, {"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804"}, {"url": "https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:20.012Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2352", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:20.012Z", "dateReserved": "2026-02-11T16:37:03.973Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-20T23:25:12.386Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Autoptimize", "vendor": "optimizingmatters", "versions": [{"lessThanOrEqual": "3.1.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration."}, {"lang": "es", "value": "El plugin Autoptimize para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del valor meta 'ao_post_preload' en todas las versiones hasta la 3.1.14, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente en la funci\u00f3n `ao_metabox_save()` y a una falta de escape de salida cuando el valor se renderiza en una etiqueta `` en `autoptimizeImages.php`. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada, siempre que la configuraci\u00f3n de \"Optimizaci\u00f3n de im\u00e1genes\" o \"Carga diferida de im\u00e1genes\" est\u00e9 habilitada en la configuraci\u00f3n del plugin."}], "id": "CVE-2026-2352", "lastModified": "2026-06-17T10:30:49.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2352", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T13:42:22.789814Z", "version": "2.0.3"}}]}, "published": "2026-03-21T00:16:25.873", "references": [{"source": "security@wordfence.com", "url": "https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.14]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Autoptimize", "source": "cna", "vendor": "optimizingmatters"}, "product": "autooptimize", "vendor": "optimizingmatters"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:42:21.935993+00:00", "value": {"mitigation_remediation": ["Upgrade Autoptimize to the latest available version (greater than 3.1.14).", "If an upgrade is unavailable, immediately disable the Image optimization and Lazy\u2011load images settings in the plugin configuration.", "If disabling the plugin is not feasible, remove any content containing the \"ao_post_preload\" meta value or manually escape it before output.", "Consider implementing a Content Security Policy that restricts the execution of inline scripts and comma\u2011detection."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Autoptimize plugin version 3.1.14 or earlier are affected. The vulnerability exists in all releases up to and including 3.1.14. Any site with the plugin installed and configured for \"Image optimization\" or \"Lazy\u2011load images\" is at risk.", "description_and_impact": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross\u2011Site Scripting because it fails to sanitize the \"ao_post_preload\" meta value and does not escape it when rendering a <link> tag. Authenticated users with Contributor level access or higher can inject arbitrary JavaScript that will run in the browser when any visitor loads a page that includes the injected value. This attack can compromise the confidentiality, integrity, and availability of the affected website\u2019s data and user sessions. The weakness is a classic input validation flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. EPSS and KEV information are not available, so the likelihood of widespread exploitation cannot be quantified, but the vulnerability requires only Contributor\u2011level credentials, which many sites grant to content editors. Because the attacker\u2019s injected script runs in the context of the site\u2019s pages, the impact can be severe, especially if the site handles sensitive user data. Sites that have disabled the affected plugin or its image optimization features will not be vulnerable. However, sites enabled for image optimization or lazy\u2011loading remain at risk until mitigated."}}}}, "created": "2026-03-23T09:51:38.834037+00:00", "updated": "2026-03-25T14:33:38.376844+00:00", "vendors": ["optimizingmatters", "optimizingmatters$PRODUCT$autooptimize", "wordpress", "wordpress$PRODUCT$wordpress"]}