CVE-2026-14995

Executive Summary

CVE-2026-14995 is a stored cross-site scripting (XSS) vulnerability in the Autoptimize WordPress plugin affecting all versions up to and including 3.1.15.1. The flaw arises from insufficient sanitization and escaping of the REQUEST_URI path, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires the Critical CSS feature to be enabled with a valid API key, making the attack surface conditional but impactful for sites using that configuration.

Technical Analysis

The vulnerability resides in the Autoptimize plugin's handling of the REQUEST_URI path. According to the NVD description, the plugin fails to properly sanitize input and escape output when processing the REQUEST_URI. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant.

The attack mechanism is tied to the Critical CSS feature. When this feature is active and a valid API key is configured, unauthenticated frontend requests can trigger queue entries via the ao_ccss_enqueue() function. The REQUEST_URI path is incorporated into these queue entries without adequate sanitization, allowing an attacker to embed malicious script content. Because the data is stored (likely in a queue or log) and later rendered, the injected script executes in the context of users who access the affected page.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates a network-exploitable, low-complexity attack requiring no privileges or user interaction, with a scope change. The scope change (S:C) suggests the vulnerable component impacts resources beyond its security scope—here, the injected script runs in the context of the victim's browser, potentially affecting other users or the broader site. Confidentiality and integrity impacts are low, while availability is not impacted.

No public proof-of-concept or exploit code is available, and no Nuclei template exists. The vulnerability class is well understood, but the specific implementation details of how ao_ccss_enqueue() processes REQUEST_URI are not provided in the description. Analysis should focus on the vulnerability class: stored XSS via unsanitized URI path in a queueing mechanism.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies WordPress sites running Autoptimize versions ≤ 3.1.15.1 with the Critical CSS feature enabled and a valid API key configured. This can be inferred from public plugin usage data or by probing for the presence of Autoptimize-specific resources.

2. Triggering the flaw: The attacker sends a crafted HTTP request to the target site. The request includes a malicious payload in the URI path. Because the Critical CSS feature is active, this request triggers a queue entry via ao_ccss_enqueue(). The insufficient sanitization allows the payload to be stored.

3. Payload/execution method: The payload is a JavaScript snippet designed to execute in the context of a victim's browser. When a user (e.g., an administrator or visitor) accesses the page where the queue entry is rendered or processed, the script executes. The exact rendering point is not specified in the description, but it is likely within the Critical CSS generation workflow or a related admin interface.

4. Post-exploitation impact: The attacker can perform actions such as session hijacking, defacement, or redirection to malicious sites, depending on the victim's privileges. Since the attack requires no authentication and no user interaction (beyond visiting the page), it poses a significant risk to site integrity and user trust.

No public PoC is available; the attack chain is inferred from the vulnerability class. The precondition of a valid API key and active Critical CSS feature limits the exploitable population but does not eliminate the risk.

Impact Assessment

The CVSS score of 7.2 (High) reflects the potential for significant impact. The scope change (S:C) means the vulnerability can affect resources beyond the plugin itself, potentially compromising the entire WordPress site or its users. Confidentiality and integrity impacts are low, but the stored nature of the XSS means that a single successful injection can affect multiple users over time.

Affected systems are WordPress installations running Autoptimize ≤ 3.1.15.1 with Critical CSS enabled and a valid API key. The blast radius includes all users who access the injected page, including administrators, editors, and visitors. Business impact may include data theft, reputational damage, regulatory penalties (e.g., GDPR if user data is compromised), and remediation costs.

Detection Guidance

Sigma Rule

title: Autoptimize Stored XSS via REQUEST_URI Path
id: 8f2c1a9b-7d4e-4f3a-9c2b-1a2b3c4d5e6f
status: experimental
description: Detects attempts to exploit CVE-2026-14995 by injecting script payloads into the REQUEST_URI path.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection
falsepositives:
  - Legitimate requests containing these strings in query parameters (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.14995

YARA Rule

rule CVE_2026_14995_Autoptimize_XSS
{
    meta:
        description = "Detects malicious script injections in Autoptimize queue entries"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14995"
        severity = "high"
    strings:
        $script1 = "<script" ascii wide nocase
        $script2 = "javascript:" ascii wide nocase
        $script3 = "onerror=" ascii wide nocase
        $script4 = "onload=" ascii wide nocase
        $autoptimize = "ao_ccss_enqueue" ascii wide
    condition:
        $autoptimize and any of ($script*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14995 Autoptimize Stored XSS Attempt"; flow:to_server,established; http.uri; content:"<script"; nocase; http.uri; content:"ao_ccss_enqueue"; nocase; classtype:web-application-attack; sid:10000001; rev:1;)

Elastic Detection

sequence by host.id, user.id with maxspan=5s
  [network where network.protocol == "http" and http.request.method == "GET" and http.request.uri contains "<script"]
  [file where file.path contains "ao_ccss_enqueue" and file.name : "*.php"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri_path=*<script* OR uri_query=*<script* OR uri_query=*javascript:*
| rex field=uri_path "(?<payload><script.*?>.*?</script>)"
| stats count values(payload) by clientip, uri_path
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <if_sid>31100</if_sid>
    <match>GET</match>
    <regex>&lt;script|javascript:|onerror=|onload=</regex>
    <description>CVE-2026-14995: Autoptimize Stored XSS attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable the Critical CSS feature in Autoptimize settings if not essential.
   • If Critical CSS is required, ensure the API key is rotated and monitor for suspicious queue entries.
   • Implement a Web Application Firewall (WAF) rule to block requests with script tags in the URI path.
   • Restrict access to the WordPress admin interface to trusted IPs.

2. Patch/upgrade steps:

   • No official patch is available as of this report. Monitor the Autoptimize plugin repository and vendor channels for updates.
   • Once a patched version is released, upgrade immediately. Verify the patch addresses the sanitization of REQUEST_URI in the Critical CSS queueing logic.

3. Long-term hardening:

   • Apply the principle of least privilege to WordPress user roles.
   • Regularly audit plugins for known vulnerabilities and remove unused plugins.
   • Implement Content Security Policy (CSP) headers to mitigate XSS impact.
   • Use a Web Application Firewall with virtual patching capabilities.
   • Enable WordPress auto-updates for security releases where feasible.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14995
• CWE-79: https://cwe.mitre.org/data/definitions/79.html
• Autoptimize Plugin Page: https://wordpress.org/plugins/autoptimize/
• WordPress Security Best Practices: https://wordpress.org/support/article/hardening-wordpress/
• CISA KEV: Not applicable (not listed)