CVE-2026-14995

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is triggered via the REQUEST URI path through the ao ccss enqueue() function. Exploitation requires the Critical CSS feature to be active and a valid API key to be configured, allowing unauthenticated frontend requests to create queue entries.

Recommendations Update to version 3.1.15.2 or later. As a temporary mitigation, disable the Critical CSS feature until the update is applied.