CVE-2026-14995 describes a stored cross-site scripting vulnerability in the Autoptimize WordPress plugin versions up to 3.1.15.1. The vulnerability is due to insufficient input sanitization and output escaping of the REQUEST_URI path, which allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation depends on the Critical CSS feature being active and configured with a valid API key, as this condition permits unauthenticated frontend requests to trigger queue entries via the ao_ccss_enqueue() function. The vulnerability can lead to script execution in the context of users visiting the affected pages.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by the Autoptimize plugin, which will execute in the browsers of users who visit those pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The attack surface is limited to installations with the Critical CSS feature enabled and a valid API key configured.

No explicit patch or fix is provided in the available data. Users should check the vendor advisory for updates or patches. Until a fix is available, disabling the Critical CSS feature or removing the API key configuration may mitigate the risk by preventing unauthenticated frontend requests from triggering the vulnerable code path.