What is the CVSS score of CVE-2026-2352?

CVE-2026-2352 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-2352?

Organizations using all should be aware of moderate risk from CVE-2026-2352, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-2352?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-2352

EUVD-2026-13838 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

GHSA-jph4-mv6f-wg9x

WordPress PHP XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13838

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the ao_metabox_save() function and missing output escaping when the value is rendered into a <link> tag in autoptimizeImages.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Autoptimize WordPress plugin through version 3.1.14, caused by insufficient input sanitization in the ao_metabox_save() function and missing output escaping when rendering the 'ao_post_preload' meta value into HTML link tags. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever users access pages with the Image optimization or Lazy-load images settings enabled, potentially affecting all users of compromised sites. The vulnerability has been patched and proof-of-concept code is available in the referenced GitHub commit.

Technical ContextAI

The Autoptimize plugin (CPE: cpe:2.3:a:optimizingmatters:autoptimize:*:*:*:*:*:*:*:*) is a WordPress optimization plugin that handles image optimization and lazy-loading. The vulnerability stems from a CWE-79 (Improper Neutralization of Input During Web Page Generation) defect affecting PHP code. Specifically, the ao_metabox_save() function in autoptimizeMetabox.php (line 276) fails to sanitize the 'ao_post_preload' post meta value during input handling, and the rendering code in autoptimizeImages.php (lines 804 and 938) fails to properly escape this value when constructing HTML link elements. This allows attacker-controlled data to reach the DOM without neutralization, enabling script injection.

RemediationAI

Immediately upgrade Autoptimize to a patched version released after 3.1.14; consult the plugin's official WordPress repository and GitHub project for the latest stable release. As a temporary mitigation pending patching, administrators should disable the Image optimization and Lazy-load images settings within the Autoptimize configuration to prevent payload execution, and restrict post editing capabilities to trusted administrative accounts only, reducing the attack surface from Contributor-level accounts. Monitor post revisions and meta values for suspicious preload directives, and consider using WordPress security plugins with XSS detection to alert on anomalous link injections in post meta data.