CVE-2026-14995
HighCVSS 7.2Summary
The Autoptimize plugin for WordPress up to version 3.1.15.1 is vulnerable to Stored Cross-Site Scripting via the REQUEST_URI path. The vulnerability is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured.
Risk Assessment
An unauthenticated attacker can inject malicious scripts that execute in the browser of any user visiting the injected page, potentially leading to session hijacking, administrator account takeover, or malware distribution.
Recommendation
Update the Autoptimize plugin to the latest patched version. Also ensure the Critical CSS feature is securely configured and not accessible to unauthenticated requests.
Other vulnerabilities in Autoptimize
See all- CVE-2026-78471Medium
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to and including 3.1.15.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.
- CVE-2025-13401Medium
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS