Security Alert Summary
The Autoptimize WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the handling of the ao_post_preload meta value. Authenticated users with Contributor-level access or higher can inject script content that may execute in pages where the plugin’s image optimization or lazy-load settings are enabled.
CVE Details
- CVE ID: CVE-2026-2352
- Affected component: Autoptimize plugin for WordPress
- Affected versions: All versions up to, and including, 3.1.14
- Published: March 21, 2026 at 12:16 AM UTC
- Last modified: March 21, 2026 at 12:16 AM UTC
- CVSS v3.1: Base score 6.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication & privileges: Attacker must be authenticated; low privileges required (Contributor-level access or higher)
- User interaction: None required
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness: CWE-79 (Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue involving the ao_post_preload post meta. Insufficient input sanitization occurs in the ao_metabox_save() function, and the value is rendered without proper escaping into a <link> tag in autoptimizeImages.php. When the plugin is configured with the “Image optimization” or “Lazy-load images” options enabled, an attacker who can save or edit post meta (Contributor-level or higher) can insert script content into the meta value. That content is persisted and will execute in the context of pages that include the affected output when visited by other users.
The issue exists because input is not sufficiently sanitized on save and the output is not escaped when printed into HTML, allowing script payloads to be stored and later executed in users’ browsers.
How This Could Impact Your Website
Consider a site with several user roles: a site owner, internal editors, and external contributors. A contributor who has access to create or edit posts could store a malicious script in the ao_post_preload meta. When an editor or site owner visits the affected page, the injected script could run in their browser. Practical consequences include limited exposure of data accessible via the browser (for example, visible user details or data accessible through the page), and an increased risk of targeted phishing or social engineering against staff whose accounts or email addresses are discovered or displayed.
The documented impact aligns with low confidentiality and integrity effects rather than full site takeover. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor-level access where not required.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected post meta changes or unexpected output in pages.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717
- https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804
- https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938
- https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276
- https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804
- https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve
