CVE-2026-14995: Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via aoccssenqueue().
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to unauthenticated exploitation?
Installations running Autoptimize version 3.1.15.1 or earlier are exposed only when the Critical CSS feature is enabled and a valid API key is configured. Those conditions allow unauthenticated frontend requests to create queue entries through ao_ccss_enqueue().
What does an attacker need to do to exploit this issue?
The attacker does not need authentication or user interaction to inject the payload. They need to submit a crafted REQUEST_URI path to an affected site meeting the Critical CSS and API-key preconditions; the stored script executes when someone later visits the injected page.
How can I determine whether my site is currently at risk?
Check the installed Autoptimize version and whether it is 3.1.15.1 or earlier. Also verify whether Critical CSS is active and configured with a valid API key, since both are required for the described unauthenticated attack path.