Description
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
Published: 2026-10-01
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting (unauthenticated)
Action: Patch Immediately
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker to insert arbitrary JavaScript into the site via the REQUEST_URI path. The script is stored by the Autoptimize plugin and later executed when pages that have the Critical CSS feature enabled load. This Stored XSS can lead to defacement, cookie theft, or session hijacking for any user who visits the affected page.

Affected Systems

All WordPress installations using the Autoptimize plugin version 3.1.15.1 or earlier are affected. The issue exists in every release up to and including 3.1.15.1, provided the Critical CSS feature is enabled and a valid API key is configured.

Risk and Exploitability

The CVSS score of 7.2 indicates a high‑risk compromise. The EPSS score is not available but the flaw is exploitable without authentication and relies on a consistent request path, making the attack straightforward. The vulnerability is not listed in the CISA KEV catalog, yet it remains a high‑impact exposure due to its wide reach across WordPress sites that have enabled Critical CSS.

Generated by OpenCVE AI on October 1, 2026 at 11:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Autoptimize plugin to a version newer than 3.1.15.1.
  • If a prompt update is not possible, temporarily disable the Critical CSS feature or remove the API key to stop unauthenticated processing of the REQUEST_URI path.
  • Apply a Content Security Policy that blocks or limits inline scripts to reduce the risk of stored XSS execution.

Generated by OpenCVE AI on October 1, 2026 at 11:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Optimizingmatters
Optimizingmatters autooptimize
Wordpress-extensions
Wordpress-extensions autoptimize
Vendors & Products Optimizingmatters
Optimizingmatters autooptimize
Wordpress-extensions
Wordpress-extensions autoptimize

Thu, 01 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
Title Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Optimizingmatters Autooptimize
Wordpress-extensions Autoptimize
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-01T14:02:56.840Z

Reserved: 2026-07-07T18:57:46.336Z

Link: CVE-2026-14995

cve-icon Vulnrichment

Updated: 2026-10-01T14:02:51.191Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T09:17:08.967

Modified: 2026-10-01T15:17:29.790

Link: CVE-2026-14995

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:36:33Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')