CVE-2026-15002

Name of the Vulnerable Software and Affected Versions Platnosci Online Blue Media (Autopay) plugin for WordPress versions prior to 5.0.1

Description Stored Cross-Site Scripting occurs via the bm woocommerce css editor content POST parameter. The Css Editor::handle save() function is linked to the WordPress init hook by Settings Manager::init once() without capability checks, nonce verification, or input sanitization. This allows unauthenticated attackers to write raw data to the woocommerce bluemedia settings option using update option(). The content is subsequently rendered without output escaping within a style block on the WooCommerce checkout page by Css Frontend::print to wp head(), enabling the execution of arbitrary web scripts when a user visits the affected page.

Recommendations Update the Platnosci Online Blue Media (Autopay) plugin for WordPress to version 5.0.1 or later.