CVE-2026-15002: Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter
The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave() method being wired to the WordPress 'init' hook by SettingsManager::initonce() with no capability check, no nonce verification, and no sanitization on the input — the raw $POST value is written to the 'woocommercebluemediasettings' option via updateoption(), then later echoed directly inside a <style> block on the WooCommerce checkout page by CssFrontend::printtowphead() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15002?
The severity of CVE-2026-15002 is classified as high with a score of 7.2.
What is the vulnerability CVE-2026-15002 related to?
CVE-2026-15002 is related to unauthenticated stored cross-site scripting via the 'bm_woocommerce_css_editor_content' parameter in the Autopay WordPress plugin.
How do I fix CVE-2026-15002?
To fix CVE-2026-15002, update the Autopay plugin to a version newer than 5.0.0.
What causes CVE-2026-15002?
CVE-2026-15002 is caused by improper input validation in the Css_Editor::handle_save() method linked to the WordPress 'init' hook.
What could be the impact of exploiting CVE-2026-15002?
Exploiting CVE-2026-15002 could allow an attacker to execute malicious scripts in the context of the user's browser, leading to data theft or session hijacking.