CVE-2026-2352 is a stored cross-site scripting vulnerability in the Autoptimize WordPress plugin (versions up to 3.1.14). The issue arises from improper neutralization of input in the 'ao_post_preload' meta value, specifically in the ao_metabox_save() function and the rendering of this value into a <link> tag within autoptimizeImages.php. Authenticated attackers with Contributor or higher privileges can exploit this to inject arbitrary scripts that execute in the context of users visiting the compromised pages, contingent on the plugin's "Image optimization" or "Lazy-load images" settings being enabled.

Successful exploitation allows an attacker with Contributor-level access or above to inject persistent malicious scripts into pages, which execute in the browsers of users viewing those pages. This can lead to information disclosure and integrity impacts (as indicated by the CVSS vector: Confidentiality and Integrity impacts are low, Availability is not affected). The attack requires no user interaction beyond visiting the affected page and leverages plugin features related to image optimization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling the "Image optimization" and "Lazy-load images" settings in the Autoptimize plugin configuration to mitigate the risk of script injection. Monitor vendor channels for updates and apply patches promptly once released.