Autoptimize - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/autoptimize/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 01 Oct 2026 10:39:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in Autoptimize WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-autoptimize-xss/Thu, 01 Oct 2026 10:39:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-autoptimize-xss/The Autoptimize WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of the REQUEST_URI path, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.The Autoptimize plugin for WordPress (versions 3.1.15.1 and earlier) contains a security flaw in how it handles the REQUEST_URI path, resulting in a Stored Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can exploit this by crafting malicious requests that include JavaScript payloads within the URI path. For the injection to succeed, the 'Critical CSS' feature must be active, and a valid API key must be configured in the plugin settings. These conditions trigger the ao_ccss_enqueue() function, which processes the malicious URI and stores the payload. When an administrative or authenticated user subsequently visits the affected page, the stored script executes in their browser, potentially leading to unauthorized actions, account takeover, or session hijacking.

Impact

Successful exploitation allows unauthenticated attackers to inject malicious scripts into WordPress sites using the Autoptimize plugin. If the payload executes in the context of an administrator, the attacker could gain full control over the WordPress instance. This vulnerability affects any environment where the Critical CSS feature is enabled, posing a high risk for websites that rely on the plugin for front-end optimization.

Recommendation

Update the Autoptimize plugin to a version greater than 3.1.15.1 to remediate CVE-2026-14995. If an immediate update is not feasible, disable the 'Critical CSS' feature in the plugin settings to mitigate the primary vector for unauthenticated exploitation until patching is complete. Monitor web access logs for unusual requests where the URI path contains script tags or common XSS payloads, focusing on POST requests targeted at the plugin's enqueue endpoint.

]]>highadvisory