Autoptimize CVE-2026-14995

Exploitation is gated on a specific non-default configuration: Autoptimize's Critical CSS feature must be active AND a valid Critical CSS API key must be configured - per the description this is the precondition that allows unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue(). On default installs where Critical CSS is disabled or no API key is set, the unauthenticated injection path is not reachable. The stored payload (an attacker-controlled REQUEST_URI path) executes when a user/administrator accesses the injected page, specifically the Critical CSS settings queue view; realized impact therefore also depends on a privileged user viewing that page. Affected versions are all releases up to and including 3.1.15.1.

The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 HIGH) describes unauthenticated, network-reachable stored XSS with a scope change (script executes in the context of any user viewing the injected page). No EPSS score, CISA KEV listing, or public POC is provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - a theoretical-but-credible issue rather than one with confirmed active exploitation. The raw 7.2 is tempered by a significant real-world gating condition the description itself states: exploitation requires the optional Critical CSS feature to be enabled AND a valid API key configured, which is the only path by which unauthenticated frontend requests reach ao_ccss_enqueue() and persist an attacker-controlled REQUEST_URI. Against Autoptimize's large install base that configuration is a minority deployment, so the effective population is much smaller than the headline PR:N suggests. The confidentiality/integrity impact is correctly rated Low (C:L/I:L) - classic reflected-into-stored XSS consequences (session/cookie theft, UI manipulation) rather than full account or data compromise. Net: a legitimate HIGH-severity-on-paper finding but moderate real-world priority, with the API-key/Critical-CSS precondition and absence of exploitation signals being the key risk reducers.

An unauthenticated attacker identifies a WordPress site running Autoptimize ≤3.1.15.1 with the Critical CSS feature active and an API key configured, then issues crafted frontend HTTP requests whose REQUEST_URI path contains a malicious script payload. The payload is enqueued via ao_ccss_enqueue() and stored unsanitized, later rendering in the Critical CSS admin settings queue view so the script executes in an administrator's browser when they review the queue. No public POC is referenced in the provided data.